skills/mukul975/anthropic-cybersecurity-skills/implementing-api-security-testing-with-42crunch/Gen Agent Trust Hub
implementing-api-security-testing-with-42crunch
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official 42Crunch CLI tool from the NPM registry and GitHub Actions from the 42Crunch organization, which are well-known and trusted sources.
- [DATA_EXFILTRATION]: The skill documents standard security practices for handling API credentials via environment variables and interactions with the official 42Crunch API endpoints.
- [PROMPT_INJECTION]: The skill includes an audit script that processes external OpenAPI specifications, representing an indirect prompt injection surface.
- Ingestion points:
scripts/agent.pyloads external OpenAPI definitions via theload_specfunction. - Boundary markers: None present in the data processing flow.
- Capability inventory: The script is limited to local file read and write operations.
- Sanitization: The script correctly uses
yaml.safe_load()to prevent potential code execution or data manipulation during YAML parsing.
Audit Metadata