webapp-pentest-checklist
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes network requests against a discovered base URL to confirm liveness and perform security probing.
- [DATA_EXFILTRATION]: The checklist identifies potential data exposure by instructing the agent to search for sensitive files on the target application, such as
/.env,/.git/config, andpackage.json. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it crawls and processes content from external web application responses and has the capability to perform subsequent network operations.
- Ingestion points: Response bodies from the target web application discovered during crawling or API documentation enumeration.
- Boundary markers: None; the skill does not implement delimiters or warnings to ignore instructions that might be embedded in the crawled content.
- Capability inventory: Ability to perform HTTP requests (GET, POST) for testing purposes.
- Sanitization: No explicit validation or filtering of the retrieved web content is performed before it is processed by the agent.
Audit Metadata