bb-methodology
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The methodology involves the analysis of untrusted data from external targets, such as JavaScript files, API responses, and web content.
- Ingestion points: Data from targets is processed during the Mapping (Phase 2) and Discovery (Phase 3) phases, as specified in the workflow checklists.
- Boundary markers: The skill incorporates a "7-Question Gate" (/validate) and a "Pre-report gate" to verify findings before reporting.
- Capability inventory: The process utilizes various third-party tools for reconnaissance and vulnerability testing, including
subfinder,nuclei,ffuf, andghauri. - Sanitization: The methodology prescribes strict "Discipline Rules" like Marker Discipline (using unique, random alphanumeric strings) and Statistical-Sample Rules to ensure observations are distinct from natural target behavior and network noise.
- [SAFE]: No malicious patterns, unauthorized data access, or obfuscation techniques were detected in the instructions. The skill focuses on legitimate security research practices and provides guidance on avoiding false positives.
Audit Metadata