hunt-shadow-api
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands such as
curl,jq,sort, andcommto automate the discovery and behavioral diffing of API endpoints and versions. - [EXTERNAL_DOWNLOADS]: Fetches historical API snapshots and search metadata from the Wayback Machine (archive.org), which is a well-known service.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves content from external target APIs and the Wayback Machine's CDX search API within Stage 2 and Stage 3 in
SKILL.md. - Boundary markers: None; the skill processes raw output from network requests without delimiters or instructions to ignore embedded content.
- Capability inventory: The skill has the capability to execute shell commands and perform file operations based on the data retrieved.
- Sanitization: There is no evidence of validation or sanitization of the downloaded OpenAPI/Swagger specifications or search results before they are processed by tools like
jq.
Audit Metadata