security-pen-testing
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute several command-line security tools including
nmap,trufflehog,gitleaks, and ecosystem audit tools (npm audit,pip audit,govulncheck,bundle audit). It also references local Python scripts (scripts/vulnerability_scanner.py,scripts/dependency_auditor.py,scripts/pentest_report_generator.py) to automate testing tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as dependency manifests and tool-generated findings JSON, which could contain malicious strings intended to influence the agent's behavior during analysis or report generation.
- Ingestion points: Instructions describe reading data from
package.json,requirements.txt, andfindings.json(SKILL.md). - Boundary markers: The instructions do not define explicit boundary markers or "ignore instructions" wrappers for the ingested data.
- Capability inventory: The skill includes file system access, network scanning via
nmap, and execution of external CLI tools and local scripts. - Sanitization: No explicit sanitization or validation procedures are provided for the content of the ingested files.
Audit Metadata