Skill
web-pentest/SKILL
|
○ declared by the publisher, as-isSafety
Safety · gateassessed 3mo ago
F9 severity-bearing · 16 informational
Graded from 9 severity-bearing findings on this release.
A gate; it passes or fails, never weighed against price or quality.
Reliability & Quality
n/a
Reliability & Qualityassessed 3mo ago
n/anot assessed
Not assessed; no producer has emitted into this category. An absence, not a zero.
Findings with severity, graded on the same letter scale as safety.
not assessed
Cost
n/a
Costassessed 3mo ago
n/anot assessed
Not assessed; no producer has emitted into this category. An absence, not a zero.
Declared external service dependencies. Never a monetary figure.
not assessed
Popularity
n/a
Popularity · not a figureassessed 3mo ago
n/anot assessed
Not assessed; no producer has emitted into this category. An absence, not a zero.
Context read off the linked repository. It enters no ranking and no grade.
not assessed
Performance tested for◌ not assessed
no controlled task evaluation on this release
Repo◌ not assessed
Vettd Note
No Vettd note yet for this asset.
Best for
Not for
Re-assessed 3mo ago · 1 of 7 categories assessed
Record lookup
◌ Vettd does not install assets; this record describes a copy you obtain yourself.
Custody chain○ no source link recorded
Unknown author ◐repo △ not assessedversion = △ no commit pinnedsha256:cmr0…cj83 ◐ signature △ not assessedlicense △ none declaredrecord c1290bcf-6108-47bb-8645-0c9508fe901d · live
Evidence · 1 of 7 categories · 25 signals · 8 soft spots
Where the record is weakest: 8 soft spots
Ranked worst first.
1Cloud metadata service probe (GCP)CriticalSafety · critical · VTD-0030
Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`
2Cloud metadata service probe (Alibaba Cloud)CriticalSafety · critical · VTD-0032
Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`
3Cloud metadata service probe (Alibaba Cloud)CriticalSafety · critical · VTD-0032
Detected in references/exploitation-techniques.md:173 — `- Alibaba/Aliyun: `http://100.100.100.200/``
Ranked 4–8: Cloud metadata service probe (AWS/standard IMDS), Cloud metadata service probe (AWS/standard IMDS), Cloud metadata service probe (AWS/standard IMDS), Cloud metadata service probe (AWS/standard IMDS), Cloud metadata service probe (GCP)
The soft spots and their evidence are identical when you are signed in.sign in
Safety● gradedFmost recent 3mo ago25 signals · 8 soft spots
how it was established25 signals · vettd · scan
show
Cloud metadata service probe (GCP)flaggedsoft spot 1Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`vettd · scan · 3moCritical
Cloud metadata service probe (Alibaba Cloud)flaggedsoft spot 2Detected in SKILL.md:63 — ``metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or`vettd · scan · 3moCritical
Cloud metadata service probe (Alibaba Cloud)flaggedsoft spot 3Detected in references/exploitation-techniques.md:173 — `- Alibaba/Aliyun: `http://100.100.100.200/``vettd · scan · 3moCritical
Cloud metadata service probe (AWS/standard IMDS)flaggedsoft spot 4Detected in SKILL.md:62 — `4. **Cloud metadata is off by default.** Do not probe `169.254.169.254`,`vettd · scan · 3moCritical
Cloud metadata service probe (AWS/standard IMDS)flaggedsoft spot 5Detected in references/scope-enforcement.md:78 — `- **Cloud metadata IPs.** `169.254.169.254` is not in any sane`vettd · scan · 3moCritical
Cloud metadata service probe (AWS/standard IMDS)flaggedsoft spot 6Detected in templates/authorization.md:40 — `- Cloud metadata endpoints (169.254.169.254, etc.) unless explicitly`vettd · scan · 3moCritical
Cloud metadata service probe (AWS/standard IMDS)flaggedsoft spot 7Detected in references/exploitation-techniques.md:169 — `- AWS: `http://169.254.169.254/latest/meta-data/iam/security-credentials/``vettd · scan · 3moCritical
Cloud metadata service probe (GCP)flaggedsoft spot 8Detected in references/exploitation-techniques.md:170 — `- GCP: `http://metadata.google.internal/computeMetadata/v1/` (needs`vettd · scan · 3moCritical
References external URL — review for indirect prompt injection riskflaggedExternal URL(s) detected in references/bypass-techniques.md — referenced content can change after auditvettd · scan · 3moMedium
scripts/ directory presentflaggedBundled executable scripts foundvettd · scan · 3moInfo
Description lacks usage contextflaggedAdd context like "Use this skill when..." to help agents know when to activate itvettd · scan · 3moInfo
Examples includedflaggedFound code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectivelyvettd · scan · 3moInfo
Validation loop referencedflaggedInstructions for the agent to validate its own work before proceedingvettd · scan · 3moInfo
references/ directory presentflaggedAdditional documentation files available for progressive disclosurevettd · scan · 3moInfo
SKILL.md body length is reasonableflagged187 lines (recommended: under 500)vettd · scan · 3moInfo
Step-by-step workflow foundflaggedStructured procedures improve reliability for complex tasksvettd · scan · 3moInfo
Progressive disclosure usedflaggedSKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfrontvettd · scan · 3moInfo
SKILL.md presentflaggedRequired skill definition file foundvettd · scan · 3moInfo
Description too briefflaggedA few sentences covering scope and trigger conditions improves activation accuracyvettd · scan · 3moInfo
CLI help supportedflaggedscripts/recon-scan.sh: Script documents its interface via --help or argument parsingvettd · scan · 3moInfo
Valid name fieldflaggedName "web-pentest" follows spec (lowercase, hyphens, ≤64 chars)vettd · scan · 3moInfo
No prompt injection or jailbreak signals detectedflaggedScanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markersvettd · scan · 3moInfo
No evaluation test casesflaggedAdd an evals/ directory with test prompts and expected outputs to measure skill qualityvettd · scan · 3moInfo
No repository linkflaggedNo repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.vettd · scan · 3moInfo
Description within character limitflagged1/1024 characters usedvettd · scan · 3moInfo
Reliability & Quality◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into reliability & quality for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Performance◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into performance for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Cost◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into cost for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Compatibility◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into compatibility for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Popularity◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into popularity for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Characteristics◌ not assessednot assessed0 signals
how it was establishednot assessed; no producer has emitted into this category
Not assessed; no producer has emitted into characteristics for this asset. That is different from a check that ran and found nothing, which the record would carry as a row of its own.
Coverage1 of 7 categories assessed · shown
Safety
✓ assessed
assessed as findings and a letter grade, not as signals
Reliability & Quality
△ not assessed
no producer has emitted for this category
Performance
△ not assessed
no producer has emitted for this category
Cost
△ not assessed
no producer has emitted for this category
Compatibility
△ not assessed
no producer has emitted for this category
Popularity
△ not assessed
no producer has emitted for this category
Characteristics
△ not assessed
no producer has emitted for this category
Freshness & re-evaluation
assessed3mo ago · Vettd core○ untracked
source stateThis asset is not yet covered by scheduled change detection.
re-check policyno re-check is scheduled for this assetnot scheduled
re-run whena new release ships, the upstream source changes, or the scanner ruleset is revisednot scheduled
Limitations & open conflicts
limitationReliability & Quality, Performance, Cost, Compatibility, Popularity, Characteristics are not assessed: behaviour there is unmeasured, not clean△ gap
conflictno two sources report the same quantity on this record
Verify: does this record describe your copy?
What record c1290bcf-6108-47bb-8645-0c9508fe901d covers
scannerv1△ superseded by v11
validityassessed 3mo ago · Staleness unknown
this record was taken at digest sha256:cmr02zq1b030… compare it against the digest your own scan prints
Reproduce: re-run the evidence yourself
runs the same scanners against your own copy; the published record is never overwritten
How this record comparesagainst other published records · full comparison →
Signal kinds
▲ finding: something to act on, carries a severity● measurement: a reproducible quantityƒ estimate: inferred from a sample▪ fact: read directly off the artifact◆ classification: assigned from a taxonomy◌ nothing found: a producer looked and emitted no object◇ context only: described, never graded
Custody marks◐ computed by vettd○ declared by the publisher, as-is△ not assessed: nothing looked