data_exfiltration
Data exfiltration attempt
Line 201Snippets
"evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token", "evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token", "evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token",exec_call
System command execution
System command execution
Line 1120Snippets
6. Never pass user input to eval(), exec(), os.system(), or child_process "recommendation": "Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.",eval_call
Use of eval()
Use of eval()
Line 405Snippets
eval()6. Never pass user input to eval(), exec(), os.system(), or child_process "recommendation": "Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.",python_pickle
Unsafe deserialization (Python pickle)
Unsafe deserialization (Python pickle)
Line 1291Snippets
2. Avoid `pickle.loads()` on untrusted data "Review code for pickle.load(), yaml.load(), Java ObjectInputStream.",python_subprocess
System command execution (Python)
System command execution (Python)
Line 1120Snippets
6. Never pass user input to eval(), exec(), os.system(), or child_processsensitive_files
Sensitive system file access
Sensitive system file access
Line 162Snippets
| **Path Traversal** | `../../../etc/passwd`, URL encoding, double encoding bypasses |fs_read
Filesystem read access
Filesystem read access
Line 2835Snippets
"pattern": r'''(?:open|readFile|readFileSync|Path\.join)\s*\(.*(?:request\.|req\.|params|args|input|user)''', "pattern": r'''(?:open|readFile|readFileSync|Path\.join)\s*\(.*(?:request\.|req\.|params|args|input|user)''',network_call
Outbound network call
Outbound network call
Line 248Snippets
curl -sI https://target.com | grep -iE "(strict-transport|content-security|x-frame|x-content-type)"If the server fetches keys from a JWKS URL in the JWT header:SSRF occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to reach internal services, cloud metadata endpoints, or other protected resources.5. Disable unnecessary URL-fetching features {"ecosystem": "npm", "package": "axios", "below": "1.6.0",Trust Score
Mis a jour il y a 2 semaines
Analyse le
31 mars 2026, 15:57
+ 2 previous scans
Compatible avec
Skill details
Mis a jour il y a 2 semaines
Analyse le 31 mars 2026, 15:57
Description
"Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation."
Scans recents
31 mars 2026, 15:57
Latest analysis
31 mars 2026, 15:12
Run 2
27 mars 2026, 15:47
Run 1