attack-surface-analyst
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides high-level architectural instructions and a data model for an EASM monitoring engine. It follows security best practices by including ethical scanning rules, mandatory rate limiting, and audit logging requirements.
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external, untrusted sources such as DNS records, certificate transparency logs (crt.sh), and web server headers. This represents a potential surface for indirect prompt injection.
- Ingestion points: External scanning sources including crt.sh API and DNS records (SKILL.md).
- Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions for the agent when processing external data.
- Capability inventory: None; the skill does not include any executable code, scripts, or direct tool invocations.
- Sanitization: Absent; there are no instructions provided for the sanitization or validation of external content prior to analysis.
Audit Metadata