hunt-csrf
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous command-line examples using
curlandgrepfor network interaction and result filtering. These are intended for security analysis and vulnerability confirmation. - [PROMPT_INJECTION]: The skill instructs the agent to analyze untrusted data from external sources (HTML, headers, cookies). Evidence chain: 1. Ingestion points: Target website responses parsed in
SKILL.md. 2. Boundary markers: None. 3. Capability inventory:curlnetwork requests andgrepparsing. 4. Sanitization: None. This represents an indirect prompt injection surface inherent to security hunting tools. - [CREDENTIALS_UNSAFE]: The skill uses placeholder session cookies (e.g.,
YOUR_SESSION) in its examples to teach manual testing. It does not provide hardcoded secrets or mechanisms for unauthorized exfiltration.
Audit Metadata