skills/mukul975/anthropic-cybersecurity-skills/implementing-epss-score-for-vulnerability-prioritization/Gen Agent Trust Hub
implementing-epss-score-for-vulnerability-prioritization
Fail
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation provides examples of fetching and processing API data from a well-known security service (api.first.org) by piping command output into a Python interpreter.\n- [EXTERNAL_DOWNLOADS]: The skill fetches vulnerability datasets and exploit probability scores from well-known organizations including FIRST, the Cyentia Institute, and CISA.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied vulnerability scan results, which creates a surface for indirect prompt injection.\n
- Ingestion points: Vulnerability metadata is read from CSV scan reports in scripts/agent.py and scripts/process.py.\n
- Boundary markers: No delimiters or safety instructions are used to distinguish ingested data from the skill's instructions.\n
- Capability inventory: The skill performs network requests and writes local files based on the content of the processed CSV files.\n
- Sanitization: Field values from external files are not sanitized or validated before use in subsequent tasks.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.first.org/data/v1/epss?cve=CVE-2024-3400 - DO NOT USE without thorough review
Audit Metadata