testing-security-tester
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No automated remote code execution or unauthorized downloads are present. The skill mentions standard security tools (ZAP, Burp Suite, sqlmap) for informational purposes without attempting to install or execute them.
- [SAFE]: No hardcoded credentials, sensitive file path access, or data exfiltration mechanisms were found.
- [PROMPT_INJECTION]: The skill includes common security testing payloads (e.g., SQL injection, XSS) as examples for the user's security testing workflow. These are handled as data/content and do not target the agent's own execution environment.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and process external vulnerability data to generate reports.
- Ingestion points: Project information fields, vulnerability descriptions, and reproduction steps in the report templates within SKILL.md.
- Boundary markers: Absent. The templates suggest direct interpolation of user-provided findings without explicit delimiters.
- Capability inventory: None. The skill does not contain executable scripts or the ability to perform network operations or file-system writes.
- Sanitization: No specific sanitization or filtering instructions are provided for the input data.
Audit Metadata