webshell-deploy
Fail
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONOBFUSCATIONPERSISTENCECREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides functional code for JSP, PHP, and ASPX webshells designed to grant unauthorized command execution capabilities.
- [COMMAND_EXECUTION]: Instructions include specific commands for establishing reverse shells and executing system-level operations on compromised hosts.
- [DATA_EXFILTRATION]: Detailed guidance is provided for accessing sensitive system files, including
/etc/passwdand/etc/shadow. - [OBFUSCATION]: The
references/webshell-payloads.mdfile (flagged as malicious by AV scanners) contains multiple evasion techniques such as base64 encoding, XOR encryption, and dynamic function calls to bypass WAF and antivirus detection. - [PERSISTENCE]: The
references/memory-webshell.mdfile documents 'memory shells' (Filter, Servlet, and Listener variants) which reside entirely in JVM memory to maintain persistence without leaving file traces. - [CREDENTIALS_UNSAFE]: The skill explicitly targets the retrieval of system password hashes from
/etc/shadow. - [DYNAMIC_EXECUTION]: The skill focuses on generating and deploying executable code at runtime to achieve persistence and command execution.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
Audit Metadata