skills/mukul975/anthropic-cybersecurity-skills/detecting-broken-object-property-level-authorization/Gen Agent Trust Hub
detecting-broken-object-property-level-authorization
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the third-party Python library
requeststo facilitate API interactions. - [COMMAND_EXECUTION]: The skill includes a standalone Python utility (
scripts/agent.py) designed to be executed via the command line to perform active scanning of API endpoints. It performs GET, PUT, PATCH, and POST requests based on user-supplied parameters. - [INDIRECT_PROMPT_INJECTION]: As a diagnostic tool, the scanner ingests data from external, untrusted API endpoints.
- Ingestion points: The
test_excessive_exposureandtest_mass_assignmentfunctions inscripts/agent.pyparse JSON responses from remote servers. - Boundary markers: None observed in the script's output report format.
- Capability inventory: The script performs network operations and parses JSON structures.
- Sanitization: The script performs structural analysis (key flattening) but does not execute the values contained within the API responses. The risk is limited to the agent potentially misinterpreting malicious property names returned in the scanner's final report.
Audit Metadata