Pentestcode AI Agent

by s0ld13rr• 915•• Scanned•Claim this listing•Request removal
Security & Testingai agentsai securityai security toolanthropicautonomous agents

PentestCode - Multi-agent AI penetration testing system with persistent engagement state, strategic coordination, and parallel autonomous operations.

Pentestcode is an open-source ai agent by s0ld13rr, written mainly in TypeScript, with 915 GitHub stars and the MIT license. Its code was last updated Oct 23, 2026.

Scan summary: scanned Nov 5, 2026 at commit b7db9cc. Seen able to run shell commands, run dynamic code, read environment and secrets, connect to the internet. Scan policy

Scanned
Full scan at b7db9cc · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit243 known vulnerabilitiesfail
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (130)

  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    packages/opencode/src/cli/cmd/github.handler.ts:295
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    packages/opencode/src/tool/inject-probe.ts:96
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    packages/opencode/src/tool/inject-probe.ts:98
  • medium
    @fastify/busboy@2.1.1: 2 known vulnerabilities
    GHSA-gxm5-99cw-xjw9, GHSA-x8mw-p69m-v3mx
    bun.lock
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    bun.lock
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    bun.lock
  • medium
    brace-expansion@2.1.1: 6 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
    bun.lock
  • medium
    brace-expansion@5.0.7: 5 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
    bun.lock
  • medium
    browserslist@4.28.4: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    bun.lock
  • medium
    dompurify@3.3.1: 21 known vulnerabilities
    GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4 +16 more
    bun.lock
  • medium
    fast-uri@3.1.3: 12 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +7 more
    bun.lock
  • medium
    fast-xml-parser@5.9.3: 1 known vulnerability
    GHSA-8r6m-32jq-jx6q
    bun.lock
  • medium
    fastify@5.10.0: 7 known vulnerabilities
    GHSA-3m5p-2c4r-xxw2, GHSA-4mh8-r7rc-xpvc, GHSA-667r-xxjv-c9mm, GHSA-9q9j-q6p8-xq58, GHSA-hwr6-493r-vm6h +2 more
    bun.lock
  • medium
    find-my-way@9.6.0: 1 known vulnerability
    GHSA-c96f-x56v-gq3h
    bun.lock
  • medium
    happy-dom@20.10.6: 3 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
    bun.lock
  • medium
    hono@4.10.7: 40 known vulnerabilities
    GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-3vhc-576x-3qv4, GHSA-458j-xx4x-4375 +35 more
    bun.lock
  • medium
    ip-address@10.2.0: 8 known vulnerabilities
    GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more
    bun.lock
  • medium
    js-yaml@3.15.0: 2 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj
    bun.lock
  • medium
    js-yaml@4.3.0: 2 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj
    bun.lock
  • medium
    minimatch@10.0.3: 4 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
    bun.lock
  • medium
    nanoid@3.3.15: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
    bun.lock
  • medium
    postcss@8.5.16: 2 known vulnerabilities
    GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
    bun.lock
  • medium
    socket.io-parser@4.2.6: 1 known vulnerability
    GHSA-2m8v-j782-fhvr
    bun.lock
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    bun.lock
  • medium
    tar@7.5.19: 1 known vulnerability
    GHSA-r292-9mhp-454m
    bun.lock
  • medium
    toml@4.1.2: 5 known vulnerabilities
    GHSA-4qx8-w7c3-pj3p, GHSA-82x6-q7mm-w9cf, GHSA-9j65-hcg3-gc64, GHSA-9qmh-m7c6-f92p, GHSA-h895-cgqg-jf52
    bun.lock
  • medium
    undici@5.29.0: 16 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52, GHSA-4992-7rv2-5pvq, GHSA-8xcm-r25x-g524 +11 more
    bun.lock
  • medium
    undici@6.27.0: 11 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524, GHSA-9fm3-97px-rjf6 +6 more
    bun.lock
  • medium
    undici@8.7.0: 23 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
    bun.lock
  • medium
    vite@7.1.4: 13 known vulnerabilities
    GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-93m4-6634-74q7, GHSA-9jrq-w75r-8gcw +8 more
    bun.lock
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    bun.lock
  • medium
    zod@4.1.8: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    bun.lock
  • medium
    Install or build failed in a clean environment
    npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "catalog:": catalog: npm error A complete log of this run can be found in: /tmp/home/.npm/_logs/2026-11-05T20_01_10_359Z-debug-0.log
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/app/e2e/performance/timeline-stability/context-matrix.spec.ts:136
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/http-recorder/test/record-replay.test.ts:136
  • low
    Possible example credential in docs/tests: curl-auth-user
    2 matches in this file
    packages/opencode/src/tool/cred-spray.txt:22
  • low
    @ai-sdk/provider-utils@4.0.21: 1 known vulnerability
    GHSA-866g-f22w-33x8
    bun.lock
  • low
    @ai-sdk/provider-utils@4.0.23: 1 known vulnerability
    GHSA-866g-f22w-33x8
    bun.lock
  • low
    @ai-sdk/provider-utils@4.0.27: 1 known vulnerability
    GHSA-866g-f22w-33x8
    bun.lock
  • low
    @babel/core@7.28.0: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    bun.lock
  • low
    @babel/core@7.28.4: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    bun.lock
  • low
    @hey-api/openapi-ts@0.90.10: 1 known vulnerability
    GHSA-hhx9-57xq-r5rw
    bun.lock
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    bun.lock
  • low
    @opentelemetry/core@2.6.1: 1 known vulnerability
    GHSA-8988-4f7v-96qf
    bun.lock
  • low
    baseline-browser-mapping@2.10.42: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    bun.lock
  • low
    diff@8.0.2: 1 known vulnerability
    GHSA-73rr-hh4g-fpgx
    bun.lock
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    bun.lock
  • low
    glob@11.1.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    bun.lock
  • low
    glob@13.0.5: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    bun.lock
  • low
    glob@9.3.5: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    bun.lock
  • low
    hono@4.12.27: 9 known vulnerabilities
    GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more
    bun.lock
  • low
    katex@0.16.27: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    bun.lock
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    bun.lock
  • low
    minimatch@8.0.7: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    bun.lock
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    bun.lock
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    bun.lock
  • low
    qs@6.15.3: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    bun.lock
  • low
    package.json has a postinstall script
    bun run --cwd packages/core fix-node-pty
    package.json
  • low
    package.json has a prepare script
    husky
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)
  • info
    Ignored the repo's scanner suppression config (1 file)
    .gitleaksignore

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Pentestcode alternatives

View more →

Similar ai agents in Security & Testing, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Pentestcode (this page)
s0ld13rr
915MITOct 23, 2026Scanned, no flagged issues
ECC
affaan-m
294kMITOct 30, 2026Scanned, no flagged issues
Strix
usestrix
73kApache-2.0Oct 30, 2026Scanned, no flagged issues
Goose
aaif-goose
56kApache-2.0Nov 1, 2026Scanned, no flagged issues
Anthropic Cybersecurity Skills
mukul975
35kApache-2.0Aug 31, 2026Scanned, no flagged issues
Pentagi
vxcontrol
33kMITOct 22, 2026Scanned, no flagged issues