hunt-grpc
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides commands to install grpcurl from its GitHub repository (github.com/fullstorydev/grpcurl) and to download a specialized testing tool for CVE-2023-44487 from a personal GitHub repository (github.com/secengjeff/rapidresetclient).- [REMOTE_CODE_EXECUTION]: The instructions for Phase 7 guide the user to clone an external repository (https://github.com/secengjeff/rapidresetclient), build the project using Go, and execute the binary locally to verify vulnerability status.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external gRPC services, which constitutes a surface for indirect instructions.
- Ingestion points: gRPC service reflection metadata and RPC method responses analyzed in Phases 2, 3, and 6.
- Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the skill body.
- Capability inventory: Execution of networking and build tools including nmap, curl, grpcurl, openssl, git, go, and protoc.
- Sanitization: The skill does not implement validation or sanitization of content received from external services before it is processed or presented.
Audit Metadata