技能 pentest-coordinator
📦
pentest-coordinator
内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
协调授权实验室渗透测试
渗透测试实验室需要在侦察、利用和权限提升各阶段进行谨慎的状态跟踪。此技能通过结构化笔记、尝试记录和完成标准来协调授权的实验室工作流。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "pentest-coordinator" from https://skillstore.io/skills/charleskozel-pentest-coordinator.md and its manifest at https://skillstore.io/api/skills/charleskozel-pentest-coordinator/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“pentest-coordinator”。 Start a scoped lab test for a provided training target.
预期结果:
该技能会创建阶段计划，记录目标范围，列出初始侦察目标，并定义何时暂停。
正在使用“pentest-coordinator”。 I found a web upload form and several failed password attempts.
预期结果:
该技能会区分 Web 测试和凭据测试，记录失败尝试，并推荐一个限定范围的下一步假设。
正在使用“pentest-coordinator”。 Review my Active Directory lab findings for privilege escalation ideas.
预期结果:
该技能会按用户权限、Kerberos 指标、证书服务和密码策略证据对发现进行分组。
安全审计
严重v8 • 2026/7/6 打开版本化报告
The scanner produced some markdown-fence false positives, but the skill intent is clearly high risk. It coordinates autonomous network scanning, exploitation, credential attacks, privilege escalation, and anti-stop behavior until user and root flags are captured. The skill should not be published without major safety controls and removal of autonomous offensive execution.
2
已扫描文件
1,669
分析行数
100
复核项
0
已忽略误报
已确认安全问题 (13)
严重
Autonomous Offensive Execution Without User Control
The skill requires continuous execution until both user and root flags are captured, forbids stopping or asking for help, and blocks summaries before completion.
Multiple sections explicitly state that the agent cannot stop, cannot ask for help, and must continue offensive actions until flags are found.
严重
End-to-End Exploitation and Privilege Escalation Objective
The skill is designed to progress from reconnaissance through exploitation and privilege escalation, including webshell execution, sudo shell escape, and root flag capture.
The purpose statement and example flow directly define the objective as compromising a target and obtaining user and root flags.
高
Network reconnaissance
- If "Everyone" or "Anonymous" is member, extensive read access
This Active Directory supplement describes using broad legacy access to read sensitive attributes such as LAPS passwords. That is actionable reconnaissance and credential exposure guidance.
高
System reconnaissance
rationale = "Avoid account lockout - spray, don't brute"
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
System reconnaissance
ONLY valid stop condition:
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
System reconnaissance
- Avoid interactive tools (use flags: `-y`, `--non-interactive`)
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
System reconnaissance
→ Each time: Check history to avoid repeating
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Network scanning tools
nmap --script=vuln,discovery -p- TARGET
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
显示全部 13 条已确认问题
高
Network scanning tools
nmap --script=vuln,discovery -p- TARGET
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Network scanning tools
Re-read nmap output
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Network scanning tools
- Port scanning strategies (nmap, masscan)
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Network scanning tools
4. **Action**: Execute `nmap -p- -T4 10.10.10.1`, update state
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Credential and Active Directory Abuse Playbook
The skill includes repeatable workflows for password spraying, PASSWD_NOTREQD exploitation, skeleton object abuse, LDAP modification, and other Active Directory attack paths.
The files provide concrete credential attack budgets and named AD abuse techniques with protocol-specific steps.
能力复核项 (100)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Ruby/shell backtick execution
15. **Action**: Trigger shell via `curl http://10.10.10.1/uploads/shell.phtml?cmd=id`
This location directs exploitation that yields command execution or a root shell, such as a webshell trigger or sudo-based shell escape. That is direct offensive capability, not benign documentation.
严重
Ruby/shell backtick execution
25. **Action**: Exploit via `sudo vim -c ':!/bin/sh'`
This location directs exploitation that yields command execution or a root shell, such as a webshell trigger or sudo-based shell escape. That is direct offensive capability, not benign documentation.
严重
Unix shell invocation
25. **Action**: Exploit via `sudo vim -c ':!/bin/sh'`
This location directs exploitation that yields command execution or a root shell, such as a webshell trigger or sudo-based shell escape. That is direct offensive capability, not benign documentation.
严重
sudo privilege escalation
25. **Action**: Exploit via `sudo vim -c ':!/bin/sh'`
This location directs exploitation that yields command execution or a root shell, such as a webshell trigger or sudo-based shell escape. That is direct offensive capability, not benign documentation.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
1. Create or load state file: `.pentest-state.json`
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
3. Set phase to `reconnaissance`
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
1. **Load current state** from `.pentest-state.json`
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
1. **Update state** with `current_action` description
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
- Search common locations: `/home/*/user.txt`, `/root/root.txt`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
- Record to `successful_paths` with details
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
- Trigger: Both `user` and `root` flags captured
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```markdown
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
```
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
- Read `user.txt` or equivalent (actual 32-char hex string)
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
- Read `root.txt` or equivalent (actual 32-char hex string)
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
- Avoid interactive tools (use flags: `-y`, `--non-interactive`)
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
```
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Ruby/shell backtick execution
```
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
**Reconnaissance Knowledge** (`.claude/skills/recon/SKILL.md`):
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Ruby/shell backtick execution
**Exploitation Knowledge** (`.claude/skills/exploitation/SKILL.md`):
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
**Privilege Escalation Knowledge** (`.claude/skills/privesc/SKILL.md`):
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
```
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
2. **Initialize**: Create `.pentest-state.json` with target, password_attempts=0, stuck_counter=0
This location is part of the skill’s coordinated reconnaissance, exploitation, and privilege escalation workflow. The context confirms an intended offensive use rather than a benign utility pattern.
高
Ruby/shell backtick execution
4. **Action**: Execute `nmap -p- -T4 10.10.10.1`, update state
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Ruby/shell backtick execution
7. **Action**: Execute `gobuster dir -u http://10.10.10.1 -w /usr/share/wordlists/dirb/common.txt`
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Ruby/shell backtick execution
18. **Action**: Execute `find /home -name user.txt 2>/dev/null`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
19. **Observation**: Found `/home/alice/user.txt`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
20. **Action**: Execute `cat /home/alice/user.txt`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
21. **Observation**: User flag captured: `abc123def456...`, update state
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
23. **Action**: Check `sudo -l`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
24. **Observation**: Can run `/usr/bin/vim` as root
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
27. **Action**: Execute `cat /root/root.txt`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
28. **Observation**: Root flag captured: `def456abc123...`, update state
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```json
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
**See**: `.claude/skills/coordinator/AD_ATTACK_SUPPLEMENT.md` for complete technique lists and comma
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
Ruby/shell backtick execution
```json
This location gives prescriptive credential or Active Directory attack workflow, including password spraying, anomaly exploitation, or repeated authentication testing. That is actionable offensive guidance.
高
Ruby/shell backtick execution
```
This location restricts stopping, status updates, user confirmation, or help requests until flags are captured. That undermines user control while driving offensive actions.
高
sudo privilege escalation
23. **Action**: Check `sudo -l`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
高
Hardcoded URL
7. **Action**: Execute `gobuster dir -u http://10.10.10.1 -w /usr/share/wordlists/dirb/common.txt`
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Hardcoded URL
15. **Action**: Trigger shell via `curl http://10.10.10.1/uploads/shell.phtml?cmd=id`
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Hardcoded IP address
4. **Action**: Execute `nmap -p- -T4 10.10.10.1`, update state
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Hardcoded IP address
7. **Action**: Execute `gobuster dir -u http://10.10.10.1 -w /usr/share/wordlists/dirb/common.txt`
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Hardcoded IP address
15. **Action**: Trigger shell via `curl http://10.10.10.1/uploads/shell.phtml?cmd=id`
This location directs network reconnaissance or web enumeration against a target using tools such as nmap, gobuster, or curl. In this skill context it is part of an autonomous attack workflow.
高
Standard device file access
18. **Action**: Execute `find /home -name user.txt 2>/dev/null`
This location supports post-exploitation activity such as flag discovery, shell handling, or privilege escalation. The surrounding workflow aims to gain user and root access.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
Update `.pentest-state.json` after EVERY action:
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Ruby/shell backtick execution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Shell command substitution
user_flag=$(jq -r '.flags.user' .pentest-state.json)
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Shell command substitution
root_flag=$(jq -r '.flags.root' .pentest-state.json)
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
中
Template literal with command substitution
```bash
This location instructs the agent to execute local shell commands for state checks or state mutation. The commands are state-focused, but they still create external command execution in a high-risk skill.
风险因素
⚙️ 外部命令 (105)
SKILL.md:17-19 SKILL.md:19-53 SKILL.md:53-55 SKILL.md:55-58 SKILL.md:58-86 SKILL.md:86-97 SKILL.md:97-160 SKILL.md:160-163 SKILL.md:163-173 SKILL.md:173-176 SKILL.md:176-191 SKILL.md:191-194 SKILL.md:194-210 SKILL.md:210-213 SKILL.md:213-249 SKILL.md:249-252 SKILL.md:252-273 SKILL.md:273-277 SKILL.md:277-294 SKILL.md:294-296 SKILL.md:296-300 SKILL.md:300-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322 SKILL.md:327-334 SKILL.md:334-344 SKILL.md:344-347 SKILL.md:347-367 SKILL.md:367-370 SKILL.md:370-379 SKILL.md:379-382 SKILL.md:382-390 SKILL.md:390-393 SKILL.md:393-398 SKILL.md:398-411 SKILL.md:411 SKILL.md:426-492 SKILL.md:492-497 SKILL.md:497-504 SKILL.md:504-514 SKILL.md:514-517 SKILL.md:517-525 SKILL.md:525-526 SKILL.md:526-529 SKILL.md:529-530 SKILL.md:530-533 SKILL.md:533-536 SKILL.md:536-573 SKILL.md:573-577 SKILL.md:577 SKILL.md:581-600 SKILL.md:600-603 SKILL.md:603-619 SKILL.md:619-622 SKILL.md:622-646 SKILL.md:646-653 SKILL.md:653-664 SKILL.md:664-667 SKILL.md:667-669 SKILL.md:669-672 SKILL.md:672-688 SKILL.md:688-696 SKILL.md:696-702 SKILL.md:702-708 SKILL.md:708-727 SKILL.md:727-734 SKILL.md:734-743 SKILL.md:743-745 SKILL.md:745-748 SKILL.md:748-760 SKILL.md:760-763 SKILL.md:763-764 SKILL.md:764-765 SKILL.md:765-766 SKILL.md:766-768 SKILL.md:768-769 SKILL.md:769-770 SKILL.md:770-772 SKILL.md:772-773 SKILL.md:773-782 SKILL.md:782-802 SKILL.md:802-827 SKILL.md:827-842 SKILL.md:842-846 SKILL.md:846-865 SKILL.md:865-871 SKILL.md:871-903 SKILL.md:903-917 SKILL.md:917-943 SKILL.md:943-1013 SKILL.md:1013-1020 SKILL.md:1020-1022 SKILL.md:1022-1031 SKILL.md:1031-1046 SKILL.md:1046-1050 SKILL.md:1050-1083 SKILL.md:1083-1086 SKILL.md:1086-1102 SKILL.md:873 SKILL.md:874 SKILL.md:871-903 SKILL.md:770 SKILL.md:768 SKILL.md:770
🌐 网络访问 (7)
📁 文件系统访问 (2)
检测到的模式
Network reconnaissanceSystem reconnaissance×4Network scanning tools×5
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/charleskozel-pentest-coordinator/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/charleskozel-pentest-coordinator?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/charleskozel-pentest-coordinator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-pentest-coordinator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/charleskozel-pentest-coordinator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
CharlesKozel. (2026). pentest-coordinator security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-pentest-coordinator/audits/8BibTeX 引用
@techreport{charleskozel-charleskozel-pentest-coordinator-2026,
author = {CharlesKozel},
title = {pentest-coordinator security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/charleskozel-pentest-coordinator/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pentest-coordinator security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/charleskozel-pentest-coordinator/audits/8"
identifiers:
- type: other
value: "skillstore:charleskozel-pentest-coordinator:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
70
社区
70
规范符合性
你能构建什么
运行 CTF 实验室练习
在许可的夺旗目标中，通过结构化笔记和阶段跟踪指导学习者。
组织内部红队实验室
在受控的企业实验室内跟踪攻击假设、失败尝试和提权路径。
教授渗透测试方法论
演示侦察发现如何关联到利用和权限提升决策。
试试这些提示
启动限定范围的实验室
Start an authorized lab assessment for target [target]. Record scope, assumptions, initial phase, and safe stop conditions.
审查当前进展
Review my current lab notes. Summarize known services, failed paths, likely next vectors, and any safety concerns.
规划 AD 调查
Given these authorized Active Directory lab findings, create a prioritized investigation plan with evidence needed for each hypothesis.
审计攻击决策
Evaluate this lab workflow for repeated methods, unsafe assumptions, missing authorization checks, and better defensive documentation.
最佳实践
- 仅在具有明确书面授权和范围的系统上使用该技能。
- 在每次网络、利用、凭据或权限提升操作之前添加人工批准。
- 保留可辩护的审计记录，包括发现、命令、时间戳和决策。
避免
- 不要在没有明确许可的情况下将该技能用于公共或第三方目标。
- 不要在没有用户确认和速率限制的情况下允许自主执行。
- 不要将 flag 获取置于安全性、合法性或范围边界之上。
常见问题
这个技能可以安全地用于真实系统吗？
仅在具有书面授权和定义明确的范围时使用。当前技能包含高风险攻击性工作流。
它会自行执行命令吗？
该技能会指示代理将执行命令作为其工作流的一部分。使用前请添加确认控制。
它能帮助防御培训吗？
可以，在受控实验室中，它可以展示发现如何引导利用和提权决策。
它支持 Active Directory 实验室吗？
支持。它包含密码策略异常、对象权限、Kerberos 和证书服务的工作流。
用户首先应该准备什么？
准备书面授权、目标范围、实验室规则、速率限制和明确的停止流程。
为什么 marketplace 审查对这个技能很重要？
该技能结合了扫描、利用、凭据测试和反停止行为。这些在发布前需要严格的防护措施。
开发者详情
作者
CharlesKozel许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
dd4a3ef9f20ddf38830950b4bb713df96b431fd6
维护新鲜度
2026/7/18
使用量
7 次下载 · 203 次浏览
文件结构