ssrf-server-side-request-forgery

Warn

Audited by Socket on Apr 22, 2026

2 alerts found:

Securityx2
SecurityMEDIUM
SKILL.md

High-risk offensive security skill. Its capabilities are internally consistent with its stated purpose, but that purpose is to help an AI agent conduct SSRF exploitation, exfiltrate callbacks, access cloud/internal secrets, and chain into RCE. This is not benign developer guidance; it is a dangerous exploit playbook.

Confidence: 97%Severity: 98%
SecurityMEDIUM
URL_PARSER_TRICKS.md

No executable behavior or runtime malicious logic is present in the provided fragment. However, the file is explicitly an offensive SSRF exploitation/weaponization guide with highly actionable payload recipes (including gopher raw-protocol payloads) and extensive internal/cloud metadata endpoint catalogs. As supply-chain content, it should be treated as security-sensitive and requires verification of whether it is shipped for legitimate training/defensive research versus misuse; if included in a production dependency, it increases attacker capability even though it does not prove malware execution by itself.

Confidence: 72%Severity: 78%
Audit Metadata
Analyzed At
Apr 22, 2026, 05:05 PM
Package URL
pkg:socket/skills-sh/yaklang%2Fhack-skills%2Fssrf-server-side-request-forgery%2F@b83814996ebc3bb66ec5ed526f645a90674b8cc9