hunt-agent-brute-force
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a self-contained Python script designed to diagnose security controls on a target server. The script uses the standard library (
urllib.request) to send multiple POST requests to a placeholder URL (https://target/agent/verify) and measure response times and content differences. This is a standard security testing pattern for identifying brute-force vulnerabilities and timing oracles. - [CREDENTIALS_UNSAFE]: The provided Python script contains a placeholder for a session cookie (
session=REPLACE). Since this is a template for diagnostic use and does not contain actual sensitive data, it does not constitute a security risk. - [DATA_EXFILTRATION]: The script performs network operations using
urllib.request.urlopen. However, these operations are directed at a user-defined target URL and do not involve reading or transmitting sensitive local files or environment variables.
Audit Metadata