web-saml
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is entirely instructional, detailing manual methods for testing SAML SSO implementations for common vulnerabilities like signature wrapping and comment injection. No executable scripts, automated network requests, or persistent mechanisms are present.
- [INDIRECT_PROMPT_INJECTION]: The skill describes techniques for capturing and manipulating external SAML assertions.
- Ingestion points: SAMLResponse base64 data captured in POST requests.
- Boundary markers: None provided in the instructions.
- Capability inventory: Use of external tools (Burp Suite, SAML Raider) for manual manipulation.
- Sanitization: None mentioned for the data manipulation steps.
Audit Metadata