recon-workbench
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes established analysis tools such as otool, nm, and codesign via shell scripts to perform target analysis. These operations are governed by an escalation ladder and a Starlark-based execution policy (recon.rules) that prompts for or forbids sensitive commands like sudo and lldb.
- [EXTERNAL_DOWNLOADS]: The skill provides automation (scripts/install_playwright.sh) to fetch the Playwright framework and required browser binaries from official registries, which are well-known and trusted sources.
- [DATA_EXFILTRATION]: The skill implements strict data handling protocols including a 'redact by default' rule for HARs and logs. The execution policy explicitly blocks outbound exfiltration tools like curl and ssh during interrogation tasks.
- [PROMPT_INJECTION]: The skill handles untrusted data from web pages and git repositories, representing an indirect prompt injection surface. Mitigations include:
- Ingestion points: Web content (web_playwright_trace.mjs) and git history (oss_git_hotspots.sh).
- Boundary markers: Enforcement of structured JSON output via --output-schema in scripts/recon.sh.
- Capability inventory: Shell subprocess execution and command generation via codex exec.
- Sanitization: A documented redaction and data handling workflow in docs/DATA_HANDLING.md.
Audit Metadata