hunt-race-condition
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a technical documentation file that teaches vulnerability research methodologies. It does not perform any automated actions or execute code on the agent's host.\n- [COMMAND_EXECUTION]: The document contains bash and Python code snippets intended as templates for the user or agent to perform network testing and static code analysis during security audits. These snippets use standard tools like
curlandgrepand do not contain malicious payloads targeting the host environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes a process that ingests external data (HTTP responses from target servers). \n - Ingestion points: Response headers and bodies from target endpoints (Step 6 of Methodology in SKILL.md).\n
- Boundary markers: None explicitly defined in the templates.\n
- Capability inventory: Network requests via
curland Pythonaiohttp, shell command execution for auditing.\n - Sanitization: Not addressed in the templates, as they focus on performance/timing metrics. This presents a theoretical vulnerability surface common to all web auditing tasks but no active exploitation is present in the skill.
Audit Metadata