recon-and-methodology
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous example commands for various security tools, including nmap, ffuf, nuclei, subfinder, amass, gobuster, feroxbuster, arjun, x8, gau, and linkfinder.py.
- [EXTERNAL_DOWNLOADS]: The playbook references many external tools and resources, such as the SecLists wordlists repository and various GitHub-hosted security projects.
- [INDIRECT_PROMPT_INJECTION]: The skill describes procedures for fetching and analyzing data from external web servers (e.g., using curl, httpx, gau), which constitutes an ingestion point for untrusted data.
- Ingestion points: Data is retrieved from remote target headers, HTML body, and JavaScript files (SKILL.md).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded malicious content in target responses are provided.
- Capability inventory: The skill utilizes network scanning and probing capabilities through various CLI tools.
- Sanitization: No sanitization of the data retrieved from external targets is performed before it is processed or displayed.
Audit Metadata