katana
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted data from external web applications (HTML, JavaScript files, and API responses). This content is processed using regex and headless browser rendering to extract endpoints.
- Ingestion points: Web content from URLs provided to the
-uor-listarguments inSKILL.mdis ingested into the agent's context when output is displayed or saved to files likekatana.jsonlorendpoints.txt. - Boundary markers: No explicit boundary markers or instructions to ignore embedded malicious prompts within the crawled content are present in the provided examples.
- Capability inventory: The skill demonstrates the ability to execute shell commands (
katana,grep,sort,cut,tr), perform network operations (web crawling), and write to the local file system (-oflag). - Sanitization: There is no evidence of sanitization or filtering to prevent the agent from interpreting instructions that might be hidden in comments or strings within the crawled JavaScript or HTML files.
Audit Metadata