defectdojo
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides hardcoded credentials for a public demo instance (admin / 1Defectdojo@demo#appsec) in SKILL.md to facilitate exploration. Additionally, references/api-v2-reference.md contains an example API token string used for documentation purposes.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions for cloning the DefectDojo source code from its official repository (github.com/DefectDojo) and downloading plugins from official sources like plugins.jenkins.io.
- [COMMAND_EXECUTION]: The skill contains numerous shell and curl examples for GitLab CI, GitHub Actions, and Jenkins pipelines which execute commands to perform vulnerability scan uploads.
- [INDIRECT_PROMPT_INJECTION]: The skill processes security scan findings from over 200 external tools, creating a surface for potential injection.
- Ingestion points: Vulnerability findings and scan reports imported into the platform via documented API endpoints.
- Boundary markers: None identified in the provided integration templates.
- Capability inventory: MCP tools provided for updating finding statuses and creating engagements.
- Sanitization: The skill relies on the DefectDojo backend for data validation and does not specify client-side sanitization.
Audit Metadata