hunt-agent-output-exfil
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as an instructional resource for security professionals. It details known attack vectors like markdown-rendered image beacons and HTML element injection without containing any active malicious triggers or obfuscated payloads. The inclusion of a self-contained Python-based 'Runnable Probe' script provides a utility for security testing; the script functions as a basic HTTP listener using only Python standard libraries to log OOB hits and does not perform sensitive file access, credential harvesting, or unauthorized network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill methodology describes exfiltration via indirect prompt injection when an agent ingests untrusted data.
- Ingestion points: SKILL.md identifies ingestion surfaces such as RAG documents, emails, and chat history that the agent processes and subsequently renders.
- Boundary markers: None identified in the skill's methodology, as it focuses on exploiting systems where markers are absent to induce malicious output.
- Capability inventory: Focuses on the agent's rendering capability (Markdown/HTML) as the primary exfiltration channel used to trigger outbound requests from a victim's client.
- Sanitization: Recommends defensive measures like stripping images/links, using content proxies, and implementing strict Content-Security-Policies (CSP).
Audit Metadata