detecting-directory-listing
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves a clear security purpose (detecting directory listings) and includes built-in safeguards such as authorization checks for remote targets and timeouts for network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests HTML and XML content from external URLs to check for server fingerprints. While this provides a theoretical surface for indirect prompt injection if a malicious server returns crafted content, the script only performs regex matching on a small sample of the body and does not execute the content, minimizing risk. Findings are documented with evidence containing only metadata (content type, sample length) rather than raw content.
- [COMMAND_EXECUTION]: The skill utilizes legitimate shell commands (
python3,curl) as specified in the allowed-tools configuration to perform its auditing tasks. It includes restrictions against dangerous operations likermor editing sensitive system files.
Audit Metadata