spray-dir-brute
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands for running the
spraydirectory brute-forcing tool. These are standard security auditing commands and do not involve shell injection or privilege escalation. - [EXTERNAL_DOWNLOADS]: A reference to the official GitHub repository for the tool (
https://github.com/chainreactors/spray) is included. This is an informational link to the source code of the tool being documented and is considered safe practice. - [DATA_EXPOSURE]: The skill references local dictionary files located in
/pentest/AboutSecurity/Dic/web/directory/. These are common paths in penetration testing environments (like Kali Linux or custom security distributions) and do not represent exfiltration of sensitive user credentials. - [REMOTE_CODE_EXECUTION]: There are no patterns involving downloading and executing remote scripts (e.g.,
curl | bash). All executions are localized to the tool's binary. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided URLs and file paths into command arguments. However, since the tool's purpose is for security professionals to perform local auditing, and the evaluation examples show standard usage, the surface for injection is typical for CLI wrapper skills and carries no elevated risk.
Audit Metadata