{"id":"cmr02zqjl033jad077mm5r8ek","slug":"web-pentestskill","publicId":"c1290bcf-6108-47bb-8645-0c9508fe901d","name":"web-pentest/SKILL","description":"|","version":"","author":null,"license":"","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":1,"fileCount":0,"hasSkillMd":false,"hasScripts":false,"hasReferences":false,"hasEvals":false,"hasAssets":false,"sourceType":"scan","sourceUrl":"","createdAt":"2026-06-30T03:22:39.775Z","completedAt":"2026-06-30T03:22:39.114Z","visibility":"public","publishedAt":"2026-07-30T19:23:46.711Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":null,"verdictPolicyVersion":null,"skillId":"cmr02zq2y0318ad071nddjkg7","findings":[{"id":"cmr02zrao03goad07nps2hzbh","source":"vettd","category":"security","label":"Cloud metadata service probe (Alibaba Cloud)","detail":"Detected in references/exploitation-techniques.md:173 — `- Alibaba/Aliyun: `http://100.100.100.200/``","severity":"critical","ruleId":"VTD-0032","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"72ca82ab9749ec355bcde946fca7e98d","filepath":""},{"id":"cmr02zrao03glad076z7ko2w1","source":"vettd","category":"security","label":"Cloud metadata service probe (Alibaba Cloud)","detail":"Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`","severity":"critical","ruleId":"VTD-0032","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"72ca82ab9749ec355bcde946fca7e98d","filepath":""},{"id":"cmr02zrao03gmad072nxu12lz","source":"vettd","category":"security","label":"Cloud metadata service probe (AWS/standard IMDS)","detail":"Detected in references/exploitation-techniques.md:169 — `- AWS: `http://169.254.169.254/latest/meta-data/iam/security-credentials/``","severity":"critical","ruleId":"VTD-0029","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"191cc1eaa6e00046ef993c9a377c456c","filepath":""},{"id":"cmr02zrao03gpad0756qaage1","source":"vettd","category":"security","label":"Cloud metadata service probe (AWS/standard IMDS)","detail":"Detected in references/scope-enforcement.md:78 — `- **Cloud metadata IPs.** `169.254.169.254` is not in any sane`","severity":"critical","ruleId":"VTD-0029","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"191cc1eaa6e00046ef993c9a377c456c","filepath":""},{"id":"cmr02zrao03gjad07ftp62kot","source":"vettd","category":"security","label":"Cloud metadata service probe (AWS/standard IMDS)","detail":"Detected in SKILL.md:62 — `4. **Cloud metadata is off by default.** Do not probe `169.254.169.254`,`","severity":"critical","ruleId":"VTD-0029","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"191cc1eaa6e00046ef993c9a377c456c","filepath":""},{"id":"cmr02zrao03gqad071dhghjbz","source":"vettd","category":"security","label":"Cloud metadata service probe (AWS/standard IMDS)","detail":"Detected in templates/authorization.md:40 — `- Cloud metadata endpoints (169.254.169.254, etc.) unless explicitly`","severity":"critical","ruleId":"VTD-0029","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"191cc1eaa6e00046ef993c9a377c456c","filepath":""},{"id":"cmr02zrao03gnad076vb7ybf0","source":"vettd","category":"security","label":"Cloud metadata service probe (GCP)","detail":"Detected in references/exploitation-techniques.md:170 — `- GCP: `http://metadata.google.internal/computeMetadata/v1/` (needs`","severity":"critical","ruleId":"VTD-0030","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6f4a49ea1f06f22774f7eceb940236fc","filepath":""},{"id":"cmr02zrao03gkad07ipxumay0","source":"vettd","category":"security","label":"Cloud metadata service probe (GCP)","detail":"Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`","severity":"critical","ruleId":"VTD-0030","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6f4a49ea1f06f22774f7eceb940236fc","filepath":""},{"id":"cmr02zrao03gsad075vmh65l3","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/bypass-techniques.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"885bf1b4de9a77b02bbb1cdf717927d5","filepath":""},{"id":"cmr02zrao03grad072kuyiamj","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmr02zrao03g9ad07j65pnxsz","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmr02zrao03g6ad07hhvhsxx0","source":"vettd","category":"structure","label":"references/ directory present","detail":"Additional documentation files available for progressive disclosure","severity":"info","ruleId":"VTD-0097","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a5f22b7185c58877c3d5a94338930d62","filepath":""},{"id":"cmr02zrao03g5ad07cdca9pmz","source":"vettd","category":"structure","label":"scripts/ directory present","detail":"Bundled executable scripts found","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmr02zrao03g4ad07crjrtnfe","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmr02zrao03g8ad07d9zm6u18","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"web-pentest\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmr02zrao03gbad07q9nqjvit","source":"vettd","category":"description","label":"Description lacks usage context","detail":"Add context like \"Use this skill when...\" to help agents know when to activate it","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cmr02zrao03gcad07bth96o34","source":"vettd","category":"description","label":"Description too brief","detail":"A few sentences covering scope and trigger conditions improves activation accuracy","severity":"info","ruleId":"VTD-0112","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592614385df5fc41eb1336fc0e003c01","filepath":""},{"id":"cmr02zrao03gaad07r5skixii","source":"vettd","category":"description","label":"Description within character limit","detail":"1/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cmr02zrao03gead07jti3ym9c","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmr02zrao03ghad075yivznxy","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmr02zrao03gdad07wbbnwyvw","source":"vettd","category":"best-practices","label":"SKILL.md body length is reasonable","detail":"187 lines (recommended: under 500)","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmr02zrao03gfad07tgwv26tg","source":"vettd","category":"best-practices","label":"Step-by-step workflow found","detail":"Structured procedures improve reliability for complex tasks","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmr02zrao03ggad07u9umtavu","source":"vettd","category":"best-practices","label":"Validation loop referenced","detail":"Instructions for the agent to validate its own work before proceeding","severity":"info","ruleId":"VTD-0105","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e5a31b775d1df438cbeb1e3fcb2ff503","filepath":""},{"id":"cmr02zrao03giad07ocpaw0uo","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/recon-scan.sh: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"bacfb1a11efd590203ff7c5670ad38d8","filepath":""},{"id":"cmr02zrao03g7ad07wc2ma5u5","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":null,"findingCount":25,"criticalCount":8,"highCount":0}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":null,"freshness":null,"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":25,"publisherSupplied":["name","description","author","version","license"]}