hunt-forgot-password
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to analyze responses from external API endpoints, which introduces a potential attack surface for indirect prompt injection if a target returns a malicious payload designed to influence the agent.
- Ingestion points: Response body, length, and HTTP status codes from external forgot-password endpoints.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the received data.
- Capability inventory: The agent is tasked with making network requests and comparing outputs across multiple probe attempts.
- Sanitization: There are no specific instructions for escaping or validating the content received from external targets.
Audit Metadata