hunt-host-header
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains multiple shell commands using
curlto perform active security probing of web server endpoints. - [REMOTE_CODE_EXECUTION]: Includes a shell pipeline using
printfandopenssl s_clientto manually craft and transmit raw HTTP requests for smuggling and header override tests. - [DATA_EXFILTRATION]: Describes a testing methodology that intentionally captures sensitive authentication tokens via out-of-band collaborator services to verify vulnerability impact.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by instructing the agent to ingest and analyze external HTTP response data.
- Ingestion points: HTTP response headers and body content retrieved from external targets via
curlandopenssl(SKILL.md). - Boundary markers: The instructions do not define specific delimiters for the external content.
- Capability inventory: The skill utilizes shell command execution and outbound network operations.
- Sanitization: No explicit sanitization or validation logic is provided for the data processed from the target servers.
Audit Metadata