skills/mukul975/anthropic-cybersecurity-skills/testing-for-xxe-injection-vulnerabilities/Gen Agent Trust Hub
testing-for-xxe-injection-vulnerabilities
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICAL
Full Analysis
- [SAFE]: The skill documentation in
SKILL.mdincludes example payloads utilizingattacker.example.comto demonstrate out-of-band data exfiltration during XXE testing. These URLs were flagged by automated scanners but are safe placeholders using a reserved domain. - [SAFE]: The included Python script
scripts/agent.pyimplements standard, non-malicious testing logic that transmits user-configured payloads to user-specified target base URLs. It does not access or exfiltrate local sensitive data from the host environment.
Recommendations
- Contains 3 malicious URL(s) - DO NOT USE
Audit Metadata