Shodan Reconnaissance and Pentesting
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the official
shodanPython package from standard repositories. - [SAFE]: All API interactions target the legitimate Shodan API (api.shodan.io), a well-known and industry-standard security service.
- [SAFE]: Credential management uses placeholders (YOUR_API_KEY) rather than hardcoded secrets, following security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data from the Shodan search engine. Ingestion point: Shodan API responses in SKILL.md. Boundary markers: None. Capability inventory: Shodan CLI, Curl, and Python network operations in SKILL.md. Sanitization: None. This surface is expected for the tool's purpose and does not involve high-risk automated execution of untrusted content.
- [COMMAND_EXECUTION]: The skill documents the use of the Shodan CLI for authorized reconnaissance, which is consistent with its stated purpose as a penetration testing utility.
Audit Metadata