Broken Authentication Testing
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructional examples for using command-line tools like Hydra to perform brute-force and credential stuffing attacks against web applications.
- [DYNAMIC_EXECUTION]: Includes a Python script snippet for collecting session tokens to evaluate their entropy and randomness during security testing.
- [INDIRECT_PROMPT_INJECTION]: The skill processes HTTP responses and session cookies from target web applications, creating an attack surface where malicious external content could influence agent behavior.
- Ingestion points: HTTP response bodies, headers, and cookies retrieved from target application endpoints defined by the user.
- Boundary markers: The instructions do not specify delimiters or constraints to differentiate between application data and potential instructions embedded in responses.
- Capability inventory: The skill utilizes the Python requests library and command-line security tools to perform network operations and authentication tests.
- Sanitization: There is no evidence of content sanitization or validation of the data returned from external target applications before processing.
Audit Metadata