security-testing-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes security testing workflows that ingest data from external sources, such as HTTP responses from target APIs and outputs from CLI security scanners. This data is untrusted and could potentially contain malicious instructions targeting the agent. * Ingestion points: API response bodies in 'references/api-security.md' and security tool outputs in 'references/penetration-testing.md'. * Boundary markers: None are defined in the provided code examples to delimit untrusted data. * Capability inventory: The skill utilizes network requests (fetch) and command-line execution for various security tools (e.g., nmap, sqlmap). * Sanitization: No explicit sanitization or validation of external data is shown before the data is processed or reported.
- [EXTERNAL_DOWNLOADS]: The skill references several third-party security tools (e.g., sqlmap, nikto, zaproxy) and official security resources from well-known organizations like OWASP and NIST.
- [COMMAND_EXECUTION]: The documentation includes examples of shell commands used to execute security scanning tools like 'nmap', 'gobuster', and 'docker' for dynamic analysis and penetration testing tasks.
Audit Metadata