skills/mukul975/anthropic-cybersecurity-skills/exploiting-mass-assignment-in-rest-apis/Gen Agent Trust Hub
exploiting-mass-assignment-in-rest-apis
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow documentation (
SKILL.md) provides multiple examples of using shell utilities such ascurl,arjun,jq, andnuclei. Additionally,scripts/agent.pyfunctions as a dedicated CLI testing script that makes dynamic external network requests to targets specified at execution time. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web responses during its analysis loop. While it presents a data ingestion surface that handles target inputs (specifically checking responses from API endpoints), the risk is bounded because the tool performs localized vulnerability inspection without complex instruction parsing.
Audit Metadata