hunting-for-webshells-in-web-servers 100/100

Is hunting-for-webshells-in-web-servers safe to install?

SaferSkills independently audited hunting-for-webshells-in-web-servers (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

hunting-for-webshells-in-web-servers/SKILL.md · 1 file

hunting-for-webshells-in-web-servers/SKILL.md1.4 KB · Markdown

name: hunting-for-webshells-in-web-servers

description: >-

Detect webshells planted on web servers by scanning for high-entropy files,

suspicious PHP/JSP/ASP patterns (eval, base64_decode, system, passthru),

recently modified files in web roots, and anomalous file sizes. Uses Shannon

entropy calculation to flag obfuscated payloads and regex pattern matching

against known webshell signatures.

domain: cybersecurity

subdomain: security-operations

tags: [hunting, for, webshells, web]

version: "1.0"

author: mahipal

license: Apache-2.0

Instructions

Install dependencies: pip install yara-python
Identify web server document roots to scan (e.g., /var/www/html, /opt/lampp/htdocs).
Run the agent to scan for webshells:

Shannon entropy analysis flags files with entropy > 5.5
Pattern matching detects eval(), base64_decode(), system(), passthru(), shell_exec()
File modification time analysis finds recently changed files
Extension filtering targets .php, .jsp, .asp, .aspx, .cgi, .py files

python scripts/agent.py --webroot /var/www/html --output webshell_report.json

Examples

High-Entropy PHP Webshell Detection

File: /var/www/html/uploads/img_thumb.php
Entropy: 6.12 (threshold: 5.5)
Patterns matched: eval(), base64_decode(), str_rot13()
Last modified: 2025-12-01 03:42:00 (outside business hours)
Verdict: SUSPICIOUS - likely obfuscated webshell

hunting-for-webshells-in-web-servers— agent skill

Is hunting-for-webshells-in-web-servers safe to install?

Instructions

Examples

High-Entropy PHP Webshell Detection

Audit the pieces. Scan the whole. Decide.