skills/mukul975/anthropic-cybersecurity-skills/coercing-authentication-with-coercer-petitpotam/Gen Agent Trust Hub
coercing-authentication-with-coercer-petitpotam
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent.pyacts as a wrapper for external security tools, executing them viasubprocess.runwith arguments passed as a list to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The instructions guide the user to install legitimate security tools from reputable sources including GitHub and PyPI.
- [DATA_EXPOSURE]: The skill handles domain credentials for authenticated coercion attacks, which are provided by the user and passed to the tools via standard command-line arguments without unauthorized exfiltration.
- [PROMPT_INJECTION]: The skill ingests hostnames and listener IPs (ingestion points in
scripts/agent.py) without explicit boundary markers; while this creates an indirect prompt injection surface, the risk is mitigated by the skill's reliance on list-basedsubprocess.runcalls (sanitization) and its specific utility for authorized security testing (capability inventory includes command execution).
Audit Metadata