automation-recon-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell command examples for chaining security tools (subfinder, dnsx, httpx, nuclei) into a pipeline. These are standard security research practices.
- [PERSISTENCE]: The documentation suggests using standard system scheduling tools like cron and systemd-timer for continuous monitoring. In the context of the skill's stated purpose (recon automation), this is a legitimate workflow suggestion rather than a malicious persistence attempt.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow that ingests untrusted external data (discovered subdomains and host response headers).
- Ingestion points: Tools like subfinder and httpx ingest data from external network sources into local files (e.g., live.txt).
- Boundary markers: None explicitly defined in the example shell pipes.
- Capability inventory: The pipeline executes several binary tools (nuclei, httpx, etc.) which perform network operations and file writes.
- Sanitization: Relies on the individual security tools' internal handling of malformed or malicious network responses.
Audit Metadata