API Fuzzing for Bug Bounty
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use command-line tools like
curl,python3, andkiterunner(kr) for API discovery and vulnerability testing. These actions are consistent with the primary purpose of security auditing. - [EXTERNAL_DOWNLOADS]: The skill contains a reference list of external security tools and wordlists hosted on GitHub and Netlify (e.g., SecLists, InQL, GraphQLmap). These are widely recognized community resources used for legitimate penetration testing and do not involve automated execution of untrusted scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a workflow for ingesting and analyzing external data such as Swagger/OpenAPI files and API server responses. This identifies a theoretical vulnerability surface for indirect prompt injection if the ingested data is maliciously crafted.
- Ingestion points:
swagger.json,openapi.json, and server responses processed at runtime. - Boundary markers: Not present; the instructions do not specify delimiters to separate untrusted content from the system prompt.
- Capability inventory: Shell command execution via
curl,kr, andpython3for testing endpoints. - Sanitization: Not implemented; the skill relies on the operator's manual validation of tool outputs.
Audit Metadata