gobuster
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external, untrusted sources (web servers and DNS responses) via the output of the
gobustertool. - Ingestion points: The agent is instructed to parse standard output or result files (documented via the
-oflag) generated by directory, DNS, and vhost enumeration commands during workflows. - Boundary markers: There are no explicit delimiters or warnings provided within the skill instructions to prevent the agent from being influenced by potentially malicious strings returned in HTTP response headers or DNS records.
- Capability inventory: The skill utilizes shell command execution to invoke the
gobusterbinary and its various modes (dir,dns,vhost, etc.). - Sanitization: The instructions do not define sanitization or validation routines for data retrieved from remote targets before it is incorporated into the agent's context.
Audit Metadata