Borrowing it
Nothing to install: this file belongs to mckinsey/agents-at-scale-ark. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mckinsey/agents-at-scale-ark/main/.claude/skills/pentest-issue-resolver/SKILL.mdgit clone --depth 1 https://github.com/mckinsey/agents-at-scale-arkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mckinsey/agents-at-scale-ark/pentest-issue-resolver)<a href="https://agentmods.dev/skills/mckinsey/agents-at-scale-ark/pentest-issue-resolver"><img src="https://agentmods.dev/badge/skills/mckinsey/agents-at-scale-ark/pentest-issue-resolver/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mckinsey/agents-at-scale-ark/pentest-issue-resolver"><img src="https://agentmods.dev/badge/skills/mckinsey/agents-at-scale-ark/pentest-issue-resolver.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Output Handling · line 72 Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.Fix: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output.
- high Anti-Refusal · line 243 Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.Fix: Remove jailbreak framing that nullifies safety policies or restrictions. Skill content must not instruct the agent to ignore its guidelines or operate without guardrails.
- high Privilege Escalation · line 623 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 949 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Tool Misuse · line 667 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 667 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- high YARA Match · line 667 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- high Tool Misuse · line 671 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 578 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.06614 |
| Opus 5 | $0.00018 | $0.03307 |
| Sonnet 5 | $0.00007 | $0.01323 |
| Haiku 4.5 | $0.00004 | $0.00661 |
Grade B, and why
ark-pentest-issue-resolver scanned grade B with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
data = pickle.loads(untrusted_data) # Can execute arbitrary code! Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
os.system(f'ls -l {filename}') # Can inject: file.txt; rm -rf / Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -I https://ark-dashboard.example.com | grep -E "X-Frame-Options|X-Content-Type-Options|Strict-Transport-Security" Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
os.system(f'ls -l {filename}') # Can inject: file.txt; rm -rf / How it starts
The opening of the file, as written. The whole thing — 1,013 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ark Penetration Test Issue Resolver
Provides detection patterns, mitigation strategies, and fixes for common penetration testing issues found in the Ark platform.
When to use this skill
Use this skill when:
- User reports a penetration testing finding without a specific CVE
- Security audit reveals OWASP Top 10 vulnerabilities
- User mentions issues like "XSS", "SQL injection", "CSRF", etc.
- Need to identify and fix common security misconfigurations
Note: This skill is used by the ark-security-patcher agent when no specific CVE is mentioned. It helps identify and resolve standard penetration testing findings.
Common Penetration Test Issues
1. SQL Injection
Description: Attacker can inject malicious SQL queries through user input.
Detection Patterns:
# VULNERABLE: Direct string concatenation
query = f"SELECT * FROM users WHERE username = '{username}'"
# VULNERABLE: String formatting
query = "SELECT * FROM users WHERE id = %s" % user_id
Mitigation:
# SECURE: Use parameterized queries
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
# SECURE: Use ORM with parameter binding
User.objects.filter(username=username)
# SECURE: Use sqlalchemy with bound parameters
session.query(User).filter(User.username == username)
Ark Context:
- Check Python services:
services/ark-api/, executor services - Search for:
cursor.execute,db.query, SQL string concatenation - Verify all database queries use parameterized statements
2. Cross-Site Scripting (XSS)
Description: Attacker can inject malicious JavaScript into web pages viewed by other users.
Types:
- Reflected XSS: Malicious script in URL/request is reflected in response
- Stored XSS: Malicious script stored in database and displayed to users
- DOM-based XSS: Vulnerability exists in client-side JavaScript
Detection Patterns:
// VULNERABLE: Direct innerHTML manipulation
element.innerHTML = userInput;
// VULNERABLE: Unescaped template rendering
return `<div>${userInput}</div>`;
// VULNERABLE: dangerouslySetInnerHTML in React
<div dangerouslySetInnerHTML={{__html: userInput}} />
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 1,013 lines · 37 tokens per session scan B e79594fd7a17
ark-pentest-issue-resolver is a skill published in the GitHub repository mckinsey/agents-at-scale-ark (423 stars, last pushed today), licensed Apache-2.0. It adds 37 tokens to every session and 6,614 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 4 findings (unrestricted tool access, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
container-manager-kubernetes-operations
Full operational Kubernetes surface via the container-manager-mcp MCP server — workloads (pods/rollouts/StatefulSets/DaemonSets/ReplicaSets/Jobs/CronJobs), config (ConfigMaps/Secrets/Namespaces/CRDs/patch), networking (Ingress/native Services/NetworkPolicy/DNS), storage (PV/PVC/StorageClass/snapshots/CSI), RBAC…
k8s-ops
Opinionated multi-step Kubernetes workflows on top of the k8s-mcp server. Encodes tool-sequencing logic and failure-mode decision trees for deploying from a repo, debugging pods/rollouts, performing safe restarts, and auditing cluster posture. Use when the user asks to deploy, diagnose, restart, roll out, or audit…
kubernetes-mesh-provisioner
Kubernetes Mesh Provisioner atomic skill. Stands up an RKE2 cluster (server + agents) with Cilium CNI and the NVIDIA GPU device plugin, the Kubernetes parallel of swarm-mesh-provisioner. Idempotent — re-runnable.
flow-nexus-platform
Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges.
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.
network-rca
Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect…