skills/jeremylongshore/tons-of-skills-marketplace/checking-http-security-headers/Gen Agent Trust Hub
checking-http-security-headers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests to user-specified URLs to retrieve and audit HTTP headers. This activity is fundamental to the skill's purpose as a scanner and involves fetching response headers using the curl tool and Python scripts. Evidence: The allowed-tools list in SKILL.md includes curl and python3, and scripts/check_headers.py implements the header retrieval logic using safe_get.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where it ingests untrusted data from external sources. 1. Ingestion points: The scripts/check_headers.py file reads response headers from external targets. 2. Boundary markers: Absent. 3. Capability inventory: The skill has network read capabilities (curl, safe_get) and generates reports for the agent context. 4. Sanitization: The script uses pattern matching to identify missing headers but does not sanitize the content before it is processed by the agent. This surface is necessary for the intended audit function.
Audit Metadata