web-info

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local PowerShell (web-info.ps1) and Python (web-info.py) scripts to collect information about the system environment, specifically targeting the Apache web server.
  • [EXTERNAL_DOWNLOADS]: The Python implementation utilizes the psutil package, a well-known and standard third-party library for retrieving information on running processes and system utilization.
  • [DATA_EXFILTRATION]: The scripts read 1C publication definition files (default.vrd) and Apache configuration files (httpd.conf). While default.vrd files may contain sensitive 1C connection strings, accessing them is required for the tool's primary purpose of reporting on web-published instances.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and displays the contents of Apache error logs, creating a potential surface for indirect prompt injection if malicious data is written to those logs.
  • Ingestion points: Data is ingested from the file system, specifically the error.log (or error_log) path derived from the Apache configuration in scripts/web-info.ps1 and scripts/web-info.py.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded commands are included when the log output is presented to the agent.
  • Capability inventory: The skill is capable of reading files, checking running processes, and performing local TCP port probes across its scripts.
  • Sanitization: The scripts do not perform sanitization or filtering on the retrieved log lines, although they do limit the output to the last five lines of error-level logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 05:16 PM