validating-cors-policies
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from web responses and configuration files. \n
- Ingestion points: Web headers retrieved via WebFetch and local files accessed via Read/Grep. \n
- Boundary markers: The instructions lack explicit delimiters to isolate untrusted data. \n
- Capability inventory: The skill uses WebFetch, Grep, and local script execution to analyze data. \n
- Sanitization: Data is processed via structured Python logic (JSON parsing and URL parsing) rather than raw prompt interpolation. \n- [SAFE]: The skill's operations are limited to its intended purpose of security auditing. No evidence of data exfiltration, unauthorized privilege escalation, or malicious obfuscation was found in the scripts or instructions.
Audit Metadata