skills/mukul975/anthropic-cybersecurity-skills/performing-security-headers-audit/Gen Agent Trust Hub
performing-security-headers-audit
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides legitimate security audit functionality for HTTP headers, and its behavior aligns perfectly with its stated purpose.
- [COMMAND_EXECUTION]: The SKILL.md file contains manual bash commands using curl and grep to inspect response headers. These are standard utilities used by security professionals for configuration review.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external HTTP headers. 1. Ingestion points: Response headers fetched from user-provided URLs in agent.py. 2. Boundary markers: The agent returns structured JSON reports, separating data from instructions. 3. Capability inventory: Limited to network GET requests to the specified target. 4. Sanitization: Data is processed using specific regex patterns and string matching to identify security directives.
- [EXTERNAL_DOWNLOADS]: The skill documentation references trusted third-party security services from well-known organizations including Mozilla Observatory, Google's CSP Evaluator, and SecurityHeaders.com.
Audit Metadata