hunt-source-leak
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands (curl, grep, sed) and Python one-liners to perform reconnaissance on target web applications.
- [EXTERNAL_DOWNLOADS]: The skill uses
pip3 installto fetch security tools likegit-dumperandds_store. It also references well-known security tools liketrufflehogandunwebpack-sourcemap. - [REMOTE_CODE_EXECUTION]: The skill contains patterns where remote data (e.g., source maps or asset manifests) is piped directly into Python interpreters for parsing.
- Evidence:
curl -s "$MAP_URL" | python3 -c "..."inSKILL.md. - Context: This is used to reconstruct original source files from JavaScript source maps locally for analysis. Given the skill's purpose as an offensive research tool, this is expected behavior.
- [DATA_EXFILTRATION]: While the skill scans for secrets (API keys, tokens), it does so within the user's local
/tmp/directory for analysis purposes. There are no patterns suggesting these findings are sent to a third-party server.
Audit Metadata