program-selection
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill's operations are consistent with its stated purpose of evaluating bug bounty targets.
- [COMMAND_EXECUTION]: The skill utilizes standard command-line tools including
dig,curl,jq, andhttpxto perform passive reconnaissance. These commands are used as intended for domain and technology fingerprinting without execution of untrusted input. - [EXTERNAL_DOWNLOADS]: Passive reconnaissance steps involve querying crt.sh, which is a well-known and established certificate transparency service.
- [PROMPT_INJECTION]: The skill processes program metadata and disclosed reports from external bug bounty platforms. Ingestion points: platform program pages and reports (SKILL.md). Boundary markers: Absent. Capability inventory: Reconnaissance CLI tools (SKILL.md). Sanitization: Absent. The risk of indirect prompt injection is considered low and inherent to the skill's primary function.
Audit Metadata