nuclei
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources, specifically a 'scope ledger' and vulnerability scan matches.
- Ingestion points: The agent is instructed to read the 'current scope ledger' and evaluate matches from template-driven scans (SKILL.md).
- Boundary markers: There are no explicit markers or instructions provided to the agent to treat this external data as potentially untrusted or to ignore instructions embedded within it.
- Capability inventory: The skill facilitates complex operations including template selection, vulnerability scanning, and writing JSONL output to the file system.
- Sanitization: The skill provides no mechanisms for sanitizing the ledger content or the scan results before they are processed by the agent's logic.
- [COMMAND_EXECUTION]: The skill's primary function is to direct the agent to execute external vulnerability scanning tools (Nuclei) and manage their output.
Audit Metadata