aegis-ssrf-url-security
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONOBFUSCATIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a framework for auditing how applications ingest and process untrusted URLs. It identifies key ingestion points (e.g., query parameters, webhook configurations) and catalogs the capabilities of mainstream HTTP libraries that serve as request sinks. It provides mandatory remediation logic, including strict hostname allowlisting and IP address pinning, to prevent the execution of malicious instructions via outbound requests.
- [OBFUSCATION]: The playbook contains educational examples of URL obfuscation, such as the use of circled digits and numeric IP encodings, to teach auditors how to identify and test for validation filter bypasses. These patterns are documented as testing payloads for security diagnostics.
- [EXTERNAL_DOWNLOADS]: The skill references security documentation from trusted organizations such as OWASP, the WHATWG URL standard, and official cloud platform documentation (AWS, GCP, Azure) to provide authoritative guidance on URL security and cloud metadata protection.
Audit Metadata