hunter-22
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs a POST request to
https://clawhunter.fun/api/v1/matchto fetch bounty opportunities. This is the primary function of the skill and uses a public API. - [COMMAND_EXECUTION]: The skill uses a local
./notifybinary to send alerts to the user. It also describes a mechanism where a user can manually trigger avuln-scannertool via a notification button. Both actions require manual operator intervention or are standard notification workflows. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a bounty marketplace. It implements several layers of filtering (triage) and deduplication logic (
hunter-22-seen.json) to minimize noise. While it ingests external bounty descriptions, the risk is low as it only surfaces links and summaries for human review rather than executing the content of the bounties.
Audit Metadata