09-web-security
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed specifically for authorized security testing and includes appropriate disclaimers and safety guidance within the 'Evidence contract' section.
- [COMMAND_EXECUTION]: The skill contains extensive libraries of command injection payloads (e.g.,
; id,$(id)) and SQL injection strings; these are provided as test case examples for scanning remote targets and are not executed in the agent's local shell environment. - [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known Python libraries such as 'requests', 'beautifulsoup4', and 'lxml' for its scanning and parsing functionality, which are sourced from official package registries.
- [INDIRECT_PROMPT_INJECTION]: While the skill interacts with untrusted external data (API responses and HTML content), it includes explicit instructions for the agent to treat all such data as untrusted evidence rather than instructions, mitigating the risk of command or prompt override from tested targets.
Audit Metadata