wp-mass-recon
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several command-line utilities including
curl,httpx,jq, andnmapthrough bash scripts inSKILL.mdand viasubprocess.runinscripts/scanner.py. These tools are used for their intended purpose of network reconnaissance and vulnerability detection. - [EXTERNAL_DOWNLOADS]: The skill fetches domain information from
crt.sh(a well-known certificate transparency service) to build its target list. This is a standard procedure for large-scale reconnaissance. - [DATA_EXFILTRATION]: The tool is designed to identify and extract sensitive configuration data (such as
.envandwp-config.php.bak) from target WordPress installations. The gathered findings are stored locally in the specified output directory and are not transmitted to any third-party command-and-control server.
Audit Metadata