web2-vuln-classes
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEPROMPT_INJECTIONOBFUSCATION
Full Analysis
- [PROMPT_INJECTION]: The skill contains several instructional overrides and role-play patterns (e.g., 'Ignore previous instructions', 'You are now in admin mode'). However, these strings are documented within the 'LLM / AI Features' section as examples for security testing and bug hunting. They do not attempt to override the actual agent's behavior or safety guidelines.
- [OBFUSCATION]: Multiple instances of Base64 encoding and other obfuscation techniques are present in the documentation (e.g., payloads for LFI and Insecure Deserialization). These are used as pedagogical examples to demonstrate how attackers bypass security filters and are not used to hide malicious logic from the analyzer.
- [OBFUSCATION]: The skill includes examples of homoglyph-based attacks, such as the use of Cyrillic characters in domains ('legіt.com') and full-width characters in IP addresses ('127。0。0。1'). These are explicitly labeled as bypass techniques for Open Redirect and SSRF vulnerabilities and do not constitute a deceptive attempt to redirect the agent.
Audit Metadata