acidrain-security-testing
Fail
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions direct the agent to clone a repository from an unverified GitHub user account (
henry-lewiskpp1107/acidrain-security-script-hub.git), which is outside the vendor's own infrastructure.- [DATA_EXFILTRATION]: The skill includes a cross-site scripting (XSS) payload example specifically designed to exfiltrate the contents ofdocument.cookieto an external host (attacker.example.com).- [CREDENTIALS_UNSAFE]: Multiple components are designed to capture sensitive authentication data, including a JavaScript utility for programmatic cookie extraction and a PHP request logger that writes all session cookies and HTTP headers to a local file.- [COMMAND_EXECUTION]: The documentation provides shell commands (git clone,cd) to download and interact with external code components at runtime.
Recommendations
- AI detected serious security threats
Audit Metadata