skills/mukul975/anthropic-cybersecurity-skills/testing-api-security-with-owasp-top-10/Gen Agent Trust Hub
testing-api-security-with-owasp-top-10
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include numerous CLI commands using
curl,ffuf, andjqfor API reconnaissance and scanning. These are standard security tools and are used here within their expected context for authorized testing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, creating an attack surface for indirect prompt injection. However, the script processes this data using structured JSON parsing for reporting, minimizing the risk of the data being interpreted as instructions by the agent.
- Ingestion points: API response bodies retrieved in
scripts/agent.pyandcurlcommands inSKILL.md. - Boundary markers: Not explicitly implemented.
- Capability inventory: Network request capabilities (
requests) and local file writing (generate_reportfunction). - Sanitization: The skill employs standard JSON decoding to extract data from responses.
- [DYNAMIC_EXECUTION]: The
scripts/agent.pyscript automates network requests and generates reports. It does not perform unsafe runtime code execution or compilation of untrusted data.
Audit Metadata