monitoring-darkweb-sources
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various external sources, including dark web forums and breach databases, which creates a surface for potential indirect prompt injection. \n
- Ingestion points: The scripts/agent.py script fetches data from the Have I Been Pwned, Dehashed, and Ransomware.live APIs (e.g., breach names, paste site titles, and ransomware victim details). \n
- Boundary markers: Results are aggregated into a text-based monitoring report in scripts/agent.py without using explicit delimiters to isolate external content. \n
- Capability inventory: The skill can perform network operations to OSINT APIs and write monitoring results to local JSON files. \n
- Sanitization: Content retrieved from external APIs is processed and displayed without specific sanitization or validation logic. \n- [DATA_EXFILTRATION]: The skill interacts with external search platforms and OSINT services to identify organizational exposures. \n
- Evidence: SKILL.md contains instructions for using curl to search psbdmp.ws and pastebin.com for specific domain keywords. \n
- Context: These operations are consistent with the skill's purpose of threat intelligence gathering and utilize standard OSINT search methodologies. \n
- Well-known services: The monitoring script utilizes established APIs from cybersecurity providers such as Have I Been Pwned and Dehashed for credential and breach monitoring.
Audit Metadata