data_exfiltration
Data exfiltration attempt
Line 201Snippets
"evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token", "evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token", "evidence": "Request: POST /api/login {\"email\": \"' OR 1=1--\", \"password\": \"x\"}\nResponse: 200 OK with admin session token",exec_call
System command execution
System command execution
Line 1120Snippets
6. Never pass user input to eval(), exec(), os.system(), or child_process "recommendation": "Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.",eval_call
Use of eval()
Use of eval()
Line 405Snippets
eval()6. Never pass user input to eval(), exec(), os.system(), or child_process "recommendation": "Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.",python_pickle
Unsafe deserialization (Python pickle)
Unsafe deserialization (Python pickle)
Line 1291Snippets
2. Avoid `pickle.loads()` on untrusted data "Review code for pickle.load(), yaml.load(), Java ObjectInputStream.",python_subprocess
System command execution (Python)
System command execution (Python)
Line 1120Snippets
6. Never pass user input to eval(), exec(), os.system(), or child_processsensitive_files
Sensitive system file access
Sensitive system file access
Line 162Snippets
| **Path Traversal** | `../../../etc/passwd`, URL encoding, double encoding bypasses |fs_read
Filesystem read access
Filesystem read access
Line 2835Snippets
"pattern": r'''(?:open|readFile|readFileSync|Path\.join)\s*\(.*(?:request\.|req\.|params|args|input|user)''', "pattern": r'''(?:open|readFile|readFileSync|Path\.join)\s*\(.*(?:request\.|req\.|params|args|input|user)''',network_call
Outbound network call
Outbound network call
Line 248Snippets
curl -sI https://target.com | grep -iE "(strict-transport|content-security|x-frame|x-content-type)"If the server fetches keys from a JWKS URL in the JWT header:SSRF occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to reach internal services, cloud metadata endpoints, or other protected resources.5. Disable unnecessary URL-fetching features {"ecosystem": "npm", "package": "axios", "below": "1.6.0",Trust Score
Updated 2周前
分析时间
2026年3月31日 15:57
+ 2 previous scans
兼容
Skill details
Updated 2周前
分析时间 2026年3月31日 15:57
说明
"Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation."
最近扫描
2026年3月31日 15:57
Latest analysis
2026年3月31日 15:12
Run 2
2026年3月27日 15:47
Run 1