wstg-security-testing
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a legitimate security auditing framework using the established OWASP WSTG methodology for educational and professional use.
- [DATA_EXFILTRATION]: Analysis of
reference/PAYLOADS.mdconfirms that sensitive file paths (e.g.,/etc/passwd) and metadata service URLs (e.g.,169.254.169.254) are documented as instructional payloads for testing external targets. No evidence was found of these being used to exfiltrate data from the local agent environment. - [COMMAND_EXECUTION]: The Python scripts
scripts/wstg_checklist.pyandscripts/wstg_lookup.pyuse standard libraries for processing local JSON data and generating markdown reports. They do not utilize unsafe subprocess calls or dynamic code execution on user-provided input. - [PROMPT_INJECTION]: The skill analyzes untrusted data such as codebase diffs and PR descriptions as part of its auditing workflow.
- Ingestion points: Source code and PR diff review modes defined in
SKILL.md. - Boundary markers: No explicit delimiters are used in the scripts to isolate untrusted data.
- Capability inventory: Execution of local utility scripts for checklist scoring and ID lookup.
- Sanitization: Relies on the host model's safety constraints as no explicit sanitization of reviewed code is performed.
Audit Metadata