tech-stack-teardown
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/recon.pyscript executesdigandcurlviasubprocess.run. It uses the recommended approach of passing arguments as a list to prevent shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill fetches data fromapi.apify.comand public websites. Apify is a well-known technology service, and these network operations are necessary for the skill's primary function.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could contain malicious instructions.\n - Ingestion points: Website HTML and DNS TXT records fetched in
scripts/recon.py.\n - Boundary markers: None identified in the report generation phase.\n
- Capability inventory: Limited to network reconnaissance; no dangerous file-system or persistent network access is present.\n
- Sanitization: The script filters incoming data through a strict list of known technology signatures and truncates potentially long DNS records, which serves as an effective control against large-scale prompt injection.
Audit Metadata