skills/mukul975/anthropic-cybersecurity-skills/testing-mobile-api-authentication/Gen Agent Trust Hub
testing-mobile-api-authentication
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate utility for mobile application security assessments. The included scripts (agent.py and process.py) perform standard security checks against user-defined API targets such as checking for alg:none in JWTs or testing for broken object-level authorization.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing data from external API responses.
- Ingestion points: API responses fetched in scripts/agent.py and scripts/process.py using the requests library are ingested into the tool's context.
- Boundary markers: None explicitly implemented; the skill relies on standard JSON parsing of responses which does not isolate potential instructions in text fields.
- Capability inventory: The skill possesses capabilities for network requests (requests) and local file writes for report generation.
- Sanitization: Responses are parsed into structured JSON data but the scripts do not perform specific sanitization for instruction-like content that could influence an LLM agent.
Audit Metadata