web-info
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local PowerShell (
web-info.ps1) and Python (web-info.py) scripts to collect information about the system environment, specifically targeting the Apache web server. - [EXTERNAL_DOWNLOADS]: The Python implementation utilizes the
psutilpackage, a well-known and standard third-party library for retrieving information on running processes and system utilization. - [DATA_EXFILTRATION]: The scripts read 1C publication definition files (
default.vrd) and Apache configuration files (httpd.conf). Whiledefault.vrdfiles may contain sensitive 1C connection strings, accessing them is required for the tool's primary purpose of reporting on web-published instances. - [INDIRECT_PROMPT_INJECTION]: The skill reads and displays the contents of Apache error logs, creating a potential surface for indirect prompt injection if malicious data is written to those logs.
- Ingestion points: Data is ingested from the file system, specifically the
error.log(orerror_log) path derived from the Apache configuration inscripts/web-info.ps1andscripts/web-info.py. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are included when the log output is presented to the agent.
- Capability inventory: The skill is capable of reading files, checking running processes, and performing local TCP port probes across its scripts.
- Sanitization: The scripts do not perform sanitization or filtering on the retrieved log lines, although they do limit the output to the last five lines of error-level logs.
Audit Metadata