hunt-nodejs
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions for identifying Node.js vulnerabilities such as Prototype Pollution and SSTI. These are intended for security research against user-provided targets.\n- [SAFE]: The automated alert for remote code execution is a false positive. The instruction 'curl -sI https://$TARGET/ | grep -i "x-powered-by|node"' filters HTTP headers using grep and does not pipe code to the Node.js runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external targets via curl, representing an ingestion point in SKILL.md. Boundary markers and sanitization are absent, and the capability inventory includes network requests. However, this risk is inherent to the skill's purpose of security auditing.
Audit Metadata