skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

insecure-source-code-management

Probe exposed VCS paths and recover backup artifacts during authorized assessments.

241|28|Updated May 20, 2026
Search Tags:#git#web security#vcs exposure#backup artifacts#authorized testing#secret leakage#subversion
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill insecure-source-code-management-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/insecure-source-code-management
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill insecure-source-code-management-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify exposed version-control metadata and backup/config artifacts (such as .git, .svn, .hg, .env, and common backup files) and recover usable evidence for authorized security assessments.

Core Features & Use Cases

  • Targeted VCS and artifact probing: Quickly checks high-value paths like /.git/HEAD, /.git/config, /.svn/entries, and /.env to determine whether source or configuration leakage is possible.
  • 403 vs 404 decisioning: Differentiates blocked directories from accessible files to prioritize extraction attempts safely.
  • Evidence-oriented recovery guidance: Recommends open-source recovery tools (e.g., git-dumper/GitTools/GitHacker, svn-extractor, mercurial dumpers, and DS_Store parsers) and a decision tree to guide next steps.
  • Scenario fit: Useful when recon finds VCS paths, directory listing restrictions (403), or leaks of backup/config artifacts during an authorized test.

Quick Start

Use the insecure-source-code-management skill to probe common VCS and backup paths on the target and interpret response codes to plan safe artifact recovery.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed .git directories and recover source code from a web target?▼

Probe high-value VCS paths like /.git/HEAD and /.git/config to detect exposed version-control metadata, then use open-source recovery tools like git-dumper or GitTools to extract the source code artifacts safely.

What is the best way to extract leaked .svn or .hg repository files during authorized testing?▼

Check paths like /.svn/entries for accessible Subversion or Mercurial metadata, differentiate 403 blocked directories from 404 missing files, and use specific dumpers like svn-extractor or mercurial dumpers for evidence recovery.

How do I check for exposed .env files and backup configuration leaks on a web server?▼

Probe for common backup and configuration artifacts like .env files and archive files using scope-safe probing techniques to identify leaked configuration data during authorized security assessments.

Why does a 403 response on a .git directory matter when probing for source code leakage?▼

A 403 response on VCS directories like .git indicates a blocked directory rather than a missing file, helping prioritize safe extraction attempts for exposed version-control metadata and backup artifacts.

Can I parse .DS_Store files to discover hidden paths and leaked artifacts on web targets?▼

Use DS_Store parsers during authorized assessments to extract directory and file names from exposed .DS_Store artifacts, revealing hidden paths and potential backup files for evidence collection.

What tools do I need to safely recover exposed VCS metadata without violating scope?▼

Use scope-safe probing and evidence handling discipline with tool-assisted extraction workflows for .git, .svn, .hg, and backup artifacts, ensuring recovery stays within authorized testing boundaries.

Related Skills

Explore More Legal & Compliance Skills→
uphiagouphiago
1.1k

scada-hikvision-isapi

Enumerate Hikvision ISAPI endpoints on SCADA and surveillance web interfaces.

Community
Intermediate
nrminornrminor

vcs-detect

Detect whether a project uses jj or git for version control.

Community
Basic
dhofheinzdhofheinz
9

Security Scan Skill

Detect exposed secrets and insecure patterns in code repositories.

Community
Intermediate
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic