mitm-find-secrets
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted network traffic data from an external file.
- Ingestion points: The
log.txtfile, which contains capturedmitmproxytraffic. - Boundary markers: The skill lacks explicit boundary markers or instructions telling the agent to treat the log content strictly as data and to ignore any embedded natural language instructions.
- Capability inventory: The skill requires file-reading capabilities and suggests the execution of shell commands via
mitmdump. - Sanitization: There is no evidence of sanitization, filtering, or validation of the log content before it is processed by the agent.
- [COMMAND_EXECUTION]: The instructions provide a specific shell command (
mitmdump --set flow_detail=3 2>&1 | tee log.txt) for the user or agent to execute. Whilemitmproxyis a legitimate security tool, providing pre-written shell commands that create files can be misused if the environment is not properly restricted.
Audit Metadata