api-auth-attacks
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill was analyzed for all 11 threat categories, and no security risks were identified.
- [PROMPT_INJECTION]: The instructions provide legitimate technical guidance for security research without attempting to bypass safety protocols or override agent behavior.
- [DATA_EXPOSURE_EXFILTRATION]: No hardcoded secrets, sensitive path access, or unauthorized data transmission patterns were found. References to credentials such as API keys and Bearer tokens are used in an educational context as examples of data to be secured.
- [REMOTE_CODE_EXECUTION]: The skill does not download or execute external scripts. The tools listed in the frontmatter, such as Burp Suite and jwt_tool, are standard security utilities appropriate for the skill's stated domain of API authentication testing.
- [OBFUSCATION]: No encoded strings, hidden characters, or techniques to conceal malicious intent were detected in either the instructions or the Sigma rule.
- [DYNAMIC_CONTEXT_INJECTION]: The skill does not use load-time shell execution placeholders or any other mechanisms for dynamic command injection.
Audit Metadata