file-upload-bypass
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous command-line instructions and code snippets for the agent to use, including shell commands for creating polyglot files, manipulating ZIP archives, and using security tools like exiftool and ffuf.
- [DATA_EXFILTRATION]: Instructions direct the agent to identify, collect, and save sensitive data found during testing (such as AWS credentials and database dumps) to the local 'engagement/evidence/' directory.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its state management mechanism:
- Ingestion points: Reads untrusted engagement state using the 'get_state_summary()' MCP tool.
- Boundary markers: Does not use delimiters or instructions to isolate external state data from the agent's core instructions.
- Capability inventory: Includes file writing capabilities and the use of network-interactive security tools.
- Sanitization: There is no evidence of validation or sanitization for the data retrieved from the state server.
Audit Metadata