enterprise-vpn-attack
Warn
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous pre-configured curl commands and bash scripts designed to exploit vulnerabilities in enterprise network appliances. This includes path traversal payloads for Cisco ASA, Fortinet, Citrix, and Pulse Secure, as well as command injection payloads for Palo Alto GlobalProtect (CVE-2024-3400) and memory disclosure payloads for Citrix Bleed (CVE-2023-4966).
- [CREDENTIALS_UNSAFE]: The instructions contain a dedicated table of factory default credentials for major VPN vendors, including Cisco ASA, Fortinet, Citrix NetScaler, Palo Alto, Pulse Secure, F5 Big-IP, and SonicWall. While these are common industry defaults, their inclusion facilitates unauthorized access attempts.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection by instructing the agent to fetch and process data from external targets across multiple vendors.
- Ingestion points: Commands utilize curl to retrieve login pages, SAML metadata, and exploit output from remote servers defined by the $TARGET variable.
- Boundary markers: There are no markers or specific instructions to the agent to treat target response data as untrusted or to ignore embedded instructions within that data.
- Capability inventory: The skill utilizes network access (curl), file system writes (writing exploit output to /tmp/), and shell command execution, which could be abused if a target server returns malicious instructions.
- Sanitization: The skill does not implement any validation or sanitization of the content returned from remote targets before the agent processes it.
Audit Metadata