nikto
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
niktoCLI tool and various bash wrapper scripts (e.g.,scripts/nikto/scan-specific-vulnerabilities.sh) to perform vulnerability scanning. It also supports writing scan results to the file system in HTML, CSV, and JSON formats using the-oand-Formatflags. - [DYNAMIC_CONTEXT_INJECTION]: The
SKILL.mdfile utilizes the!command syntax to execute shell commands at load time. These commands check for the presence of theniktobinary and the existence of local wrapper scripts to provide status updates to the agent. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from external web servers when performing vulnerability scans (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from interpreting content from scanned web applications as instructions.
- Capability inventory: The skill possesses the capability to execute shell commands (
bash,nikto) and perform file system writes (SKILL.md). - Sanitization: The skill does not implement sanitization or filtering for the external content retrieved during scanning operations.
Audit Metadata