ssl-cert-check
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow relies on executing bash commands via
opensslto inspect remote endpoints. These commands are executed in a shell environment, which is a powerful capability. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (specifically command injection) by interpolating the user-provided
$HOSTvariable directly into shell commands without sanitization. - Ingestion points: The hostname input provided by the user in response to triggers like "Check the SSL cert on example.com".
- Boundary markers: No delimiters or safety instructions (e.g., "ignore embedded characters") are used when the variable is placed into the shell script blocks.
- Capability inventory: The skill uses shell execution for
openssl,grep, andechooperations across multiple steps inSKILL.md. - Sanitization: The instructions do not include logic to validate the hostname or escape shell metacharacters (e.g.,
;,&,|) before the agent executes the commands.
Audit Metadata