skills/jeremylongshore/tons-of-skills-marketplace/mapping-findings-to-owasp-top10/Gen Agent Trust Hub
mapping-findings-to-owasp-top10
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes pentest findings from external sources which may contain attacker-controlled data from scanned targets. The enriched output is intended for consumption by downstream executive summary skills, forming a multi-step execution chain.
- Ingestion points:
scripts/map_owasp.py(lines 157-183) loads records from JSON/JSONL files in thefindings/directory. - Boundary markers: Absent. The script does not implement delimiters or 'ignore' instructions to wrap the processed finding content.
- Capability inventory:
scripts/map_owasp.pyperforms multiple file-write operations (lines 267-279 and 290-333) to produce enriched findings and coverage reports. - Sanitization: Absent. The script processes findings content using standard JSON/YAML libraries but does not sanitize or escape the strings before they are passed to the next stage of the reporting pipeline.
Audit Metadata