file-upload
Fail
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The instructions provide ten specific techniques to bypass security filters, such as extension blacklist evasion, null byte injection, and content-type spoofing, aimed at overriding system constraints.
- [REMOTE_CODE_EXECUTION]: The skill includes functional web shell payloads (e.g.,
<?php system($_GET['c']); ?>) and instructions for achieving execution via .htaccess modification, polyglot files, and ZIP-slip techniques. - [COMMAND_EXECUTION]: It provides terminal commands (e.g.,
printf,zip,curl) for the agent to create malicious files with forged magic bytes and probe remote systems for vulnerabilities. - [DATA_EXFILTRATION]: The skill includes XSS payloads designed to steal session cookies and transmit them to external, attacker-controlled domains such as
attacker.com. - [REMOTE_CODE_EXECUTION]: The skill defines techniques for path traversal and filename injection to overwrite system files or upload executable code to sensitive directories.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- AI detected serious security threats
Audit Metadata