Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pentesterflow/agent/ssrfnpx skills add PentesterFlow/agent --skill ssrfgit clone --depth 1 https://github.com/PentesterFlow/agentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00703 |
| Opus 5 | $0.00018 | $0.00351 |
| Sonnet 5 | $0.00007 | $0.00141 |
| Haiku 4.5 | $0.00004 | $0.00070 |
Grade C, and why
ssrf scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Group probes by outcome to fingerprint the parser (Python urllib? Java URL? curl? net/http?). How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SSRF playbook
You suspect a parameter is being fetched server-side. Confirm it, escalate it, prove impact.
Execution rule: use the actual parameter, callback host, and target URL before running commands. Never write literal placeholders such as <endpoint> or <role> to files; if the collaborator/canary host is missing, ask once.
1. Confirm the primitive
Send the http request with the parameter pointing to:
- An out-of-band canary the user provides (interactsh / burp collaborator / a netcat listener they own)
- Compare to a control value to confirm the server is doing the fetch
If the canary fires, you have at minimum a blind SSRF.
2. Map filter behavior
Probe how the server validates the URL. For each probe, capture status and body:
http://127.0.0.1,http://localhost,http://0.0.0.0- IPv6:
http://[::1],http://[::ffff:127.0.0.1] - Decimal/octal:
http://2130706433,http://0177.0.0.1 - DNS rebinding hosts the user provides
- Schemes:
gopher://,file:///etc/passwd,dict://,ftp:// - Redirect chain: a user-controlled URL that 302s to internal target
Group probes by outcome to fingerprint the parser (Python urllib? Java URL? curl? net/http?).
3. Hit cloud metadata
If you suspect AWS:
GET http://169.254.169.254/latest/meta-data/iam/security-credentials/
GET http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
If IMDSv2 is enforced, attempt to obtain the token via the same SSRF if the primitive supports headers.
For GCP: http://metadata.google.internal/computeMetadata/v1/ with Metadata-Flavor: Google.
For Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01 with Metadata: true.
4. Internal service discovery
With the SSRF confirmed, sweep common internal ports/paths from the victim's perspective: :80, :443, :6379 (Redis), :9200 (Elastic), :8500 (Consul), :2375 (Docker), :25 (SMTP). Use response time + body fingerprint.
5. Prove impact
- Stolen credentials → demonstrate by listing one S3 bucket / one GCS bucket the role can reach (read-only).
- Internal admin panel → fetch a single page that's clearly internal.
- Source code / config disclosure → grab one file via
file://or internal HTTP.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 54 lines · 37 tokens per session scan C f89b1babde75
ssrf is a skill published in the GitHub repository PentesterFlow/agent (1,316 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 37 tokens to every session and 703 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
osint
Drive extroosint with the right kind, feeds, pivots, and keys.
cwe
Exhaustively test a target against every applicable CWE.
penetration-testing
Run a scoped pentest with NmapIt, Burp, Metasploit, and a written report.
pwn-ai-agent-curriculum
Drive PWN::AI::Agent::Curriculum from pwneval.
pwn-ai-agent-loop
Drive PWN::AI::Agent::Loop from pwneval.
pwn-ai-agent-reward
Drive PWN::AI::Agent::Reward from pwneval.