Skills/PyPI/pentester-mcp

pentester-mcp@0.5.0

CAUTION· not started

Publisher claims: "Authorization-gated penetration testing MCP server for agentic AI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher keselyoleren · publishing for 12 daysInstalls 671Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BURP_API_KEYBURP_AUTH_STYLEDEFECTDOJO_API_KEYNVD_API_KEYSHODAN_API_KEYZAP_API_KEYConfiguration, not credentials: BURP_API_URL, DEFECTDOJO_URL, ZAP_API_URL
Where it talks to
no vendor host named in the codeAlso pentest-canary.example, crt.sh, archive.org, amazonaws.com, shodan.io, schemastore.org, nist.gov, evil-pentest.example — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names pentest-canary.example, crt.sh, archive.org, amazonaws.com, shodan.io, schemastore.org, nist.gov, evil-pentest.example as well as its own vendor. The guard injects BURP_API_KEY, BURP_AUTH_STYLE, DEFECTDOJO_API_KEY, NVD_API_KEY, SHODAN_API_KEY, ZAP_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx pentester-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompt injection; Prompt injection; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-guardrails/SKILL.md:3 · Prompt injection — known jailbreak technique reference…san scope, larangan DoS, penanganan temuan sensitif (kredensial, data pribadi), dan kapan harus menolak permintaan pengujian. --- # Guardrails pengujian keamanan …Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-workflow/SKILL.md:24 · Prompt injection — known jailbreak technique referencecertificate transparency, Wayback, subdomain takeover dan cloud asset.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/webapp.py:179 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSENSITIVE_PATHS = {".git/HEAD", ".env", ".DS_Store", "dump.sql", "backup.zip"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-guardrails/SKILL.md:40 · Prompt injection — known jailbreak technique referencehanya bila `rules.allow_payload_execution = true` dan user sudah memberi konfirmasiFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/ctf.py:739 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"%2e%2e%2f%2e%2e%2fetc%2fpasswd", "....//....//etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-guardrails/SKILL.md:33 · Prompt injection — known jailbreak technique reference- Hormati `rules.rate_limit_rps` dan jendela `rules.window`. Di luar jendela, stop.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedsrc/pentest_agent/runner.py:100 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-guardrails/SKILL.md:16 · Prompt injection — known jailbreak technique referencetanggal berlaku, daftar target, dan rules of engagement.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Destructive command against a filesystem root or devicetests/test_advanced.py:123 · Destructive command against a filesystem root or deviceexploit.payload_generate("windows/x64/meterpreter/reverse_tcp; rm -rf /", "10.0.0.1", 4444,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedsrc/pentest_agent/tools/ctf.py:712 · OS command execution function call detected"{{''.__class__.__mro__[1].__subclasses__()}}", "{{cycler.__init__.__globals__.os.popen('id').read()}}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
AWS access key pattern detectedtests/test_advanced.py:58 · AWS access key pattern detected — possible hardcoded or harvested keyassert "AKIAEXAMPLEKEY123456" not in joinedFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Destructive file system command detectedtests/test_runner.py:19 · Destructive file system command detected_check_args(["echo", "$(rm -rf /)"])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_advanced.py:123 · Destructive file system command detectedexploit.payload_generate("windows/x64/meterpreter/reverse_tcp; rm -rf /", "10.0.0.1", 4444,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_advanced.py:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert [h["path"] for h in result["hits"]] == [".env", "admin", "backup.zip"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-workflow/SKILL.md:17 · Prompt injection — known jailbreak technique referenceKalau `nmap`/`nuclei`/`sqlmap` belum ada, sampaikan cara install dan tawarkanFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-workflow/SKILL.md:27 · Prompt injection — known jailbreak technique reference- `pentest_osint_crtsh(domain)` dan `pentest_osint_wayback(domain)` untuk subdomainFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-guardrails/SKILL.md:35 · Prompt injection — known jailbreak technique referencewordlist kecil dan rate rendah.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/ctf.py:715 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"../../../../etc/passwd", "....//....//....//etc/passwd", "/proc/self/environ",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/ctf.py:783 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresp = client.get(url, params={param: "....//....//....//....//etc/passwd"})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/webapp.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"robots.txt", "sitemap.xml", ".git/HEAD", ".env", ".DS_Store", "server-status",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_advanced.py:206 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert "Sensitive path exposed: /.env" in titlesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Dense URL-encoded contentsrc/pentest_agent/tools/ctf.py:739 · Dense URL-encoded content — may be obfuscating payloads"%2e%2e%2f%2e%2e%2fetc%2fpasswd", "....//....//etc/passwd",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/pentest_agent/server.py:152 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Probe sensitive paths (e.g. .git/HEAD, .env) on an in-scope URL: built-in wordlist, or ffuf with use_ffuf=True."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_advanced.py:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{"input": {"FUZZ": ".env"}, "status": 200, "length": 42, "content-type": "text/plain"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-workflow/SKILL.md:3 · Prompt injection — known jailbreak technique reference… recon, pemindaian kerentanan, pengujian web app, eksploitasi (bila diizinkan), dan penulisan laporan. Pakai saat user meminta asesmen keamanan, pentest, vulnerabi…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
AWS access key pattern detectedtests/test_advanced.py:54 · AWS access key pattern detected — possible hardcoded or harvested keytext = 'config = {"aws_key": "AKIAEXAMPLEKEY123456", "token": "ghp_' + "a" * 36 + '"}'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Access to sensitive file pathssrc/pentest_agent/skills/pentest-workflow/SKILL.md:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- `pentest_web_dirbust(url)` untuk path sensitif (`.git`, `.env`, backup).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/ctf.py:720 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"; id", "| id", "`id`", "$(id)", "%0a id", "& whoami", ";cat /etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/webapp.py:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesseverity="high" if path in {".env", ".git/HEAD", "dump.sql"} else "medium",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionsrc/pentest_agent/skills/pentest-workflow/SKILL.md:26 · Prompt injection — known jailbreak technique reference- `pentest_recon_whois(domain)` untuk data registrasi dan nameserver.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/pentest_agent/tools/vulnscan.py:421 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"\blfi\b|file inclusion|remote file|\.git|\.env|credential|password|backup|dump|"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈3,483 tok
2 files · 38 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for pentester-mcp@0.5.0 as of 47 min ago. This is the package itself, not its dependencies.

What would make this Verified

13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim keselyoleren: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Destructive command against a filesystem root or device≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim keselyolerenPropose a patch to the maintainer