[PR #343] fix: avoid unsupported XSStrike flags in pentester prompt #329

New Issue

2026-06-06T22:10:15-04:00

yindo commented

2026-06-06 22:10:15 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/343
Author: @mason5052
Created: 6/6/2026
Status: 🔄 Open

Base: main ← Head: codex/issue-335-xsstrike-args

📝 Commits (1)

0d40ad8 fix: avoid unsupported XSStrike flags in prompts

📊 Changes

2 files changed (+42 additions, -0 deletions)

View changed files

📝 backend/pkg/templates/prompts/pentester.tmpl (+6 -0)
📝 backend/pkg/templates/templates_test.go (+36 -0)

📄 Description

Summary

Add a narrow Pentester prompt guardrail for XSStrike command construction and cover it with a template-rendering regression test.

Problem

Issue #335 reports PentAGI executing xsstrike with unsupported -c and -o /dev/null arguments. Investigation did not find a hardcoded XSStrike command or -c -o /dev/null pattern in repo prompts, schemas, config, examples, or docs. The issue evidence shows the installed XSStrike help output rejects those flags, so the likely failure mode is model-generated CLI flag reuse during pentest command composition.

Solution

Update backend/pkg/templates/prompts/pentester.tmpl with a small CLI argument protocol that tells the Pentester agent to verify tool-specific flags, avoid copying flags across tools, and specifically avoid xsstrike -c or xsstrike -o unless the installed xsstrike --help documents them.

Add TestPentesterPromptXSStrikeArgumentGuidance to ensure the rendered Pentester prompt keeps this guardrail in place.

User Impact

Users running XSS testing flows should be less likely to hit the reported XSStrike argument error. This does not change runtime tool execution, Docker image contents, schemas, frontend behavior, or unrelated tools.

Test Plan

go test ./pkg/templates - passed in a Go-enabled verification environment.
git diff --check - passed.
rg -n -i "xsstrike|xss strike|xssstrike" backend frontend examples README.md --glob '!backend/pkg/tools/testdata/sploitus_result_nginx.json' - only the new guardrail and regression test mention XSStrike.
rg -n -- "xsstrike -c|xsstrike -o|-o /dev/null|unrecognized arguments" backend frontend examples README.md - only the new negative guidance/test references xsstrike -c and xsstrike -o; no stale executable example remains.
docker image ls vxcontrol/kali-linux / xsstrike --help - not run locally because Docker is not installed in this environment; XSStrike CLI behavior was verified from the Issue #335 evidence.

Refs #335

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/343 **Author:** [@mason5052](https://github.com/mason5052) **Created:** 6/6/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/issue-335-xsstrike-args` --- ### 📝 Commits (1) - [`0d40ad8`](https://github.com/vxcontrol/pentagi/commit/0d40ad8f25648b589761f5ff46bea7cb84f053e8) fix: avoid unsupported XSStrike flags in prompts ### 📊 Changes **2 files changed** (+42 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/pkg/templates/prompts/pentester.tmpl` (+6 -0) 📝 `backend/pkg/templates/templates_test.go` (+36 -0) </details> ### 📄 Description ## Summary Add a narrow Pentester prompt guardrail for XSStrike command construction and cover it with a template-rendering regression test. ## Problem Issue #335 reports PentAGI executing `xsstrike` with unsupported `-c` and `-o /dev/null` arguments. Investigation did not find a hardcoded XSStrike command or `-c -o /dev/null` pattern in repo prompts, schemas, config, examples, or docs. The issue evidence shows the installed XSStrike help output rejects those flags, so the likely failure mode is model-generated CLI flag reuse during pentest command composition. ## Solution Update `backend/pkg/templates/prompts/pentester.tmpl` with a small CLI argument protocol that tells the Pentester agent to verify tool-specific flags, avoid copying flags across tools, and specifically avoid `xsstrike -c` or `xsstrike -o` unless the installed `xsstrike --help` documents them. Add `TestPentesterPromptXSStrikeArgumentGuidance` to ensure the rendered Pentester prompt keeps this guardrail in place. ## User Impact Users running XSS testing flows should be less likely to hit the reported XSStrike argument error. This does not change runtime tool execution, Docker image contents, schemas, frontend behavior, or unrelated tools. ## Test Plan - `go test ./pkg/templates` - passed in a Go-enabled verification environment. - `git diff --check` - passed. - `rg -n -i "xsstrike|xss strike|xssstrike" backend frontend examples README.md --glob '!backend/pkg/tools/testdata/sploitus_result_nginx.json'` - only the new guardrail and regression test mention XSStrike. - `rg -n -- "xsstrike -c|xsstrike -o|-o /dev/null|unrecognized arguments" backend frontend examples README.md` - only the new negative guidance/test references `xsstrike -c` and `xsstrike -o`; no stale executable example remains. - `docker image ls vxcontrol/kali-linux` / `xsstrike --help` - not run locally because Docker is not installed in this environment; XSStrike CLI behavior was verified from the Issue #335 evidence. Refs #335 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:10:15 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: vxcontrol/pentagi#329