web-webauthn-software-authenticator
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a process that involves ingesting untrusted data from external web servers and using that data to generate signed assertions.
- Ingestion points: The skill processes registration and authentication options (challenges, RP IDs, user IDs) received from server endpoints (
/register/begin,/auth/begin) described inSKILL.md. - Boundary markers: None. The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when handling the external challenge data.
- Capability inventory: The skill uses Python's
cryptographylibrary for ECDSA signing andcbor2for data serialization, as well as making network requests to finish registration/authentication ceremonies. - Sanitization: The skill does not mention sanitizing the server-provided challenges or metadata, which could lead to command or prompt injection if the data is reflected into other agent workflows.
Audit Metadata