cloud-s3-exposure
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes data from untrusted external sources which is then used to construct shell commands.
- Ingestion points: As described in the Method section of SKILL.md, the agent is instructed to extract bucket names and identifiers from asset URLs, JavaScript source code, and DNS CNAME records.
- Boundary markers: Absent. The instructions provide no delimiters or specific warnings to the agent regarding the handling of these extracted strings.
- Capability inventory: The skill utilizes powerful CLI tools including
awscliandgsutilfor listing, reading, and writing files (aws s3 ls,aws s3 cp,gsutil ls). - Sanitization: Absent. The skill does not provide instructions for validating or escaping the strings extracted from web assets before they are used as arguments in shell commands, creating a surface for command injection.
- [COMMAND_EXECUTION]: The skill relies on the execution of multiple system-level CLI tools (
aws,gsutil,s3scanner,gcpbucketbrute) to perform its primary function. While consistent with the stated bug bounty use case, the direct use of external data in these commands presents an inherent risk.
Audit Metadata