SMTP Penetration Testing
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute various command-line tools for network scanning, banner grabbing, and password testing, including nmap, netcat, hydra, and msfconsole.
- [PRIVILEGE_ESCALATION]: Includes instructions to use sudo for installing security tools via the system package manager (apt-get) in the prerequisites section.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting and acting upon untrusted data from remote SMTP servers, such as service banners and protocol command responses.
- Ingestion points: Network response data from target SMTP servers processed by nmap, nc, and smtp-user-enum during service discovery and banner grabbing phases.
- Boundary markers: Absent; the instructions do not include delimiters or specific warnings to ignore instructions embedded in target responses.
- Capability inventory: The agent is instructed to use various powerful CLI tools for network interaction, DNS lookups, and brute-force authentication attacks.
- Sanitization: Absent; no mention of sanitizing or validating the data retrieved from external servers before it enters the agent's context.
Audit Metadata