Loading ToolBench
MCP server that executes arbitrary Kali Linux commands (e.g., nmap, gobuster, sqlmap, hydra, nikto) securely inside a container and returns terminal output.
Single tool with critical security and design flaws. Tool name 'run_kali_command' is generic and does not follow verb_noun convention clearly. Description is adequate (156 chars) but lacks critical safety guidance. Input schema present but minimal: single string parameter with no format constraints, validation rules, or examples. No output schema documented. No error handling guidance for LLM recovery. Tool accepts arbitrary shell commands with shell=True, creating severe injection and privilege escalation risks. No input sanitization, no rate limiting, no permission gates, no audit logging.
Executes any arbitrary Kali Linux command (e.g., nmap, gobuster, sqlmap, hydra, nikto) securely inside the container and returns the terminal output.
No input validation or sanitization. Tool accepts arbitrary shell commands with shell=True, enabling command injection, privilege escalation, and destructive attacks. LLM can be tricked via prompt injection to pass malicious payloads (e.g., 'rm -rf /', 'cat /etc/shadow').
No output schema documented. LLM cannot predict response structure or plan downstream operations. Returns unstructured string combining STDOUT/STDERR with no field typing.
No error handling guidance. Timeout and generic exceptions return raw error strings. LLM has no recovery path, cannot retry intelligently, cannot ask user for clarification, cannot suggest alternatives.
No permission gates or audit logging. Tool executes any command as container root with no access control, no user attribution, no compliance trail. Violates pattern:permission-gate and pattern:audit-trail.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Parameter 'command' lacks format constraints, length limits, and validation rules. Description does not specify allowed commands, forbidden patterns, or examples. LLM cannot self-validate input.