web-pentest
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the automated use of security tools such as
nmap,curl, andwhatweb. These actions are governed by a mandatory authorization protocol and a strict hostname/CIDR scope allowlist implemented in thescripts/recon-scan.shwrapper script.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as its primary operation involves retrieving and processing untrusted data (HTML, headers, scripts) from external web targets. \n - Ingestion points: External content is ingested via
browser_navigate,curl, andwhatwebduring the reconnaissance and vulnerability analysis phases.\n - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard embedded commands within the analyzed web content.\n
- Capability inventory: The agent has access to terminal execution for network tools and filesystem access to store evidence and findings.\n
- Sanitization: The skill includes explicit instructions (Phase 4.6) to redact captured credentials from chat history to prevent data leakage via auxiliary model processing, though it does not filter incoming web content before analysis.\n- [DATA_EXFILTRATION]: The exploitation workflow (Phase 4.3) recommends using operator-owned callback hosts for SSRF (Server-Side Request Forgery) verification. While this is standard practice in penetration testing, it presents a potential data exfiltration vector if the callback endpoint is not properly secured or is misconfigured.
Audit Metadata