hunt-laravel
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads code from an external GitHub repository.
- Evidence:
git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rceinSKILL.md. - [REMOTE_CODE_EXECUTION]: The skill executes a downloaded script using the PHP interpreter, which could lead to arbitrary code execution if the source is compromised.
- Evidence:
php /tmp/laravel-rce/exploit.php https://$TARGET "id"inSKILL.md. - [DATA_EXFILTRATION]: The skill explicitly targets sensitive files that contain credentials, API keys, and environment variables.
- Evidence: Commands accessing
/.env,/.env.production, and/storage/logs/laravel.loginSKILL.md. - [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to fingerprint targets and execute exploits.
- Evidence: Usage of
curl,grep,php, andpython3 -m json.toolacross various phases inSKILL.md. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes unvalidated content from external web servers.
- Ingestion points: Output from
curlrequests to$TARGETinSKILL.md. - Boundary markers: None present to separate external content from instructions.
- Capability inventory: Shell execution via
git clone,php, andpython3inSKILL.md. - Sanitization: No evidence of output sanitization or validation before processing.
- [NO_CODE]: The skill instructions reference an external script
laravel_cookie_forge.pywhich is missing from the provided skill files.
Recommendations
- HIGH: Downloads and executes remote code from: https://$TARGET/telescope/api/redis, https://$TARGET/telescope/api/requests, https://$TARGET/telescope/api/commands - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata