configuring-ldap-security-hardening

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the ldap3 library via pip, which is a standard and well-known Python package for LDAP interactions.
  • [COMMAND_EXECUTION]: The skill involves the execution of a Python auditing script (scripts/agent.py) that performs network-based security checks and writes JSON reports to the local file system.
  • [CREDENTIALS_UNSAFE]: The scripts/agent.py utility accepts a sensitive password as a command-line argument (--password). This practice can lead to credential exposure in system process lists or shell history logs.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external LDAP servers, creating a surface for indirect prompt injection if the output is interpreted by an agent without sanitization.
  • Ingestion points: The script retrieves directory objects and user attributes (such as sAMAccountName) from the target LDAP server via conn.search in scripts/agent.py.
  • Boundary markers: No specific delimiters or boundary instructions are used when printing findings or generating the JSON report.
  • Capability inventory: The skill possesses network communication capabilities (LDAP/LDAPS) and file-write capabilities (JSON report generation).
  • Sanitization: The script does not perform sanitization or filtering on the content retrieved from the directory service before displaying it or saving it to the report file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:16 AM