traceroute
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax to perform environment checks when the skill is loaded. These commands verify whether required system tools and local scripts are available.
- Evidence: Found
!command -v traceroute ..., `!`command -v mtr ..., and!test -f scripts/traceroute/trace-network-path.sh ...`` inSKILL.md. - [COMMAND_EXECUTION]: The instructions direct the agent to execute system binaries and local shell scripts to perform network path analysis and latency diagnostics.
- Evidence: Use of
traceroute,mtr, and scripts located inscripts/traceroute/such astrace-network-path.shandcompare-routes.sh. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from external network diagnostic tools, which represents an ingestion point for potentially untrusted data from the network (e.g., hop hostnames).
- Ingestion points: Output from
tracerouteandmtrcommands. - Boundary markers: Not explicitly defined in the skill instructions.
- Capability inventory: The skill can execute local shell scripts and system networking binaries.
- Sanitization: The skill documentation mentions that targets are validated against a scope configuration file (
.pentest/scope.json) via a PreToolUse hook.
Audit Metadata