hash-attack-techniques
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides functional code and specific command-line instructions for cryptographic attacks, including the use of tools like HashPump, fastcoll, and hashclash for exploiting hash vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for a timing attack tool that processes data from external web services, which represents an indirect prompt injection surface.
- Ingestion points: Network responses are ingested via the
requests.getcall within thehmac_timing_attackfunction inSKILL.md. - Boundary markers: None. The script does not use delimiters or instructions to ignore potential commands embedded in the response data.
- Capability inventory: The skill uses
requestsfor network operations andhashlibcombined withhlextendfor hash manipulation and forgery. - Sanitization: There is no validation, escaping, or sanitization of the data retrieved from the target URL before it is processed by the agent logic.
Audit Metadata