Skills/PyPI/pwncat-mcp

pwncat-mcp@0.0.3

CAUTION· install only

Publisher claims: "Reverse and bind shell automation framework with MCP server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher vip3r-mc · publishing for 97 daysInstalls 62Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso cryptography.io, githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- uvx pwncat-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commandpwncat/commands/listeners.py:157 · Process kill command — agent can terminate processesself.parser.error("cannot use both kill and init arguments")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/gtfobins.py:6 · Privileged sudo command — agent may execute with elevated privilegeswith things like SETUID binaries and sudo rules. A full list of all supportedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/platform/linux.py:1558 · Privileged sudo command — agent may execute with elevated privilegessudo_command = "sudo -p 'Password: ' "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspwncat/modules/linux/implant/passwd.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Implant tracker for a user added directly to /etc/passwd"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspwncat/data/gtfobins.json:1480 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"payload": "TERM= {command} /etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandpwncat/gtfobins.py:98 · Privileged sudo command — agent may execute with elevated privileges"""Check if this method is compatible with the given sudo command spec.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/gtfobins.py:104 · Privileged sudo command — agent may execute with elevated privilegesIf this method is incompatible with the given sudo spec, SudoNotPossibleFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspwncat/platform/__init__.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath = session.platform.Path("/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandpwncat/platform/linux.py:1629 · Privileged sudo command — agent may execute with elevated privilegesraise PermissionError("incorrect password or sudo permissions")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/platform/__init__.py:912 · Privileged sudo command — agent may execute with elevated privilegesraise NotImplementedError(f"sudo not implemented for platform {self.name}")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedpwncat/data/gtfobins.json:957 · OS command execution function call detected"'import os; os.system(\"{shell} -p\");gimp.exit()'"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedpwncat/data/gtfobins.json:1662 · OS command execution function call detected"payload": "TF=$({mktemp} -u); echo 'import os; os.system(\"{shell} -p\"); exit(0)' > $TF; {command}; {rm} -f $TF",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/gtfobins.py:29 · Privileged sudo command — agent may execute with elevated privileges"""The given sudo command spec is not compatible with the method attempted."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/platform/linux.py:1592 · Privileged sudo command — agent may execute with elevated privilegesraise PermissionError("incorrect password or sudo permissions")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/platform/linux.py:1616 · Privileged sudo command — agent may execute with elevated privileges# We use a longer timeout because sudo sometimes waitsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspwncat/modules/linux/implant/passwd.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith session.platform.open("/etc/passwd", "w") as filp:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspwncat/modules/linux/implant/passwd.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise ModuleFailed("failed to read /etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspwncat/modules/linux/implant/passwd.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise ModuleFailed("failed to write /etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandpwncat/commands/listeners.py:156 · Process kill command — agent can terminate processesif args.kill and args.init:Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat_mcp/server.py:442 · Privileged sudo command — agent may execute with elevated privileges"description": "Execute a command with sudo on the remote target.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandpwncat/platform/linux.py:1560 · Privileged sudo command — agent may execute with elevated privilegessudo_command = "sudo -n "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandpwncat/commands/listeners.py:153 · Process kill command — agent can terminate processesif (args.kill or args.init) and args.id is None:Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspwncat/facts/linux.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Normally, the hash is only stored in /etc/shadowFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandpwncat/gtfobins.py:101 · Privileged sudo command — agent may execute with elevated privilegesof arguments that need to be added_lines to the sudo spec in order for it toFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspwncat/modules/linux/implant/passwd.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith session.platform.open("/etc/passwd", "r") as filp:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandpwncat/platform/__init__.py:265 · File permission modification command — agent changes file ownership/permissions"""Modify a symbolic link's mode (same as chmod for non-symbolic links)"""Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedpwncat/platform/linux.py:1006 · Python subprocess execution detectedsubprocess.run(command, check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandpwncat/data/gtfobins.json:1614 · File permission modification command — agent changes file ownership/permissions"payload": "TF=$({mktemp} -d); echo '#!{shell} -p' > $TF/groff; echo '{shell} -p' >> $TF/groff; chmod +x $TF/groff; GROFF_BIN_PATH=$TF {command}",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandpwncat/platform/linux.py:1163 · Process kill command — agent can terminate processes# things can get wonky. We prevent that by kill stdin unlessFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandpwncat/commands/sessions.py:40 · Process kill command — agent can terminate processesif args.list or (not args.kill and args.session_id is None):Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandpwncat/data/gtfobins.json:612 · File permission modification command — agent changes file ownership/permissions"--eval '(chmod \"{shell}\" #o4755)'",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandpwncat/commands/sessions.py:13 · Process kill command — agent can terminate processesto change context between sessions or kill active sessions which wereFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedpwncat/commands/local.py:18 · Python subprocess execution detectedsubprocess.run(args, shell=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandpwncat_mcp/server.py:1023 · Process kill command — agent can terminate processes# kill the wedged remote process so command_running resetFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈50 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for pwncat-mcp@0.0.3 as of 47 min ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim vip3r-mc: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim vip3r-mcPropose a patch to the maintainer