skills/jeremylongshore/tons-of-skills-marketplace/composing-vulnerability-report/Gen Agent Trust Hub
composing-vulnerability-report
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill does not exhibit any signs of malicious obfuscation, persistence, or credential exfiltration. Its functionality is strictly limited to local file processing and reporting.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external findings data from files located in
engagements/*/findings/. This represents an attack surface where maliciously crafted findings could attempt to influence downstream agent behavior via the generated report. However, the risk is mitigated by the skill's structural validation of JSON records and its lack of high-privilege capabilities. - [COMMAND_EXECUTION]: Shell command execution is constrained by the
allowed-toolsanddisallowed-toolsconfiguration in the skill's frontmatter. It permits only specificpython3invocations and file management tools while explicitly blocking network utilities likecurlandwgetand sensitive file modifications.
Audit Metadata