hunt-spa-api
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
curlfor interacting with target endpoints andgrepfor extracting information from public assets. These commands are localized to the task of security reconnaissance and testing.- [EXTERNAL_DOWNLOADS]: The skill fetches HTML and JavaScript bundles from a target domain (usingtarget.comas a placeholder). These downloads are used for static analysis viagrepand are not executed, piped to a shell, or used to update the agent's own environment.- [DATA_EXPOSURE]: The skill includes regex patterns designed to identify hardcoded secrets (such as AWS keys, Stripe keys, and JWTs) within the target application's public JavaScript bundles. This is a core part of its intended security-testing purpose and does not involve the exfiltration of the agent's or user's sensitive data.
Audit Metadata