api-fuzzing-bug-bounty
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a large number of external security tools and wordlists hosted on GitHub, Netlify, and GitHub Gists. These include well-known community resources such as SecLists, Kiterunner, and InQL.
- [COMMAND_EXECUTION]: The instructions involve executing various command-line interface (CLI) tools for API discovery and scanning (e.g.,
kr scan) as well as running Python scripts (e.g.,json2paths.py) to process API documentation. - [INDIRECT_PROMPT_INJECTION]: The skill contains logic to ingest and parse untrusted external data, specifically Swagger and OpenAPI JSON documentation files, to automate endpoint discovery.
- Ingestion points: Reads
swagger.jsonandopenapi.jsonfrom target servers. - Boundary markers: None explicitly defined in the workflow for parsing these files.
- Capability inventory: Subprocess execution (Python, CLI tools) and network operations (curl, scanner tools).
- Sanitization: The skill relies on external scripts (
json2paths.py) for parsing, and the safety of the interaction depends on the underlying agent's handling of the resulting endpoint list.
Audit Metadata