file-path-traversal
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides specific methods and target paths to access sensitive information on target systems, including password hashes (
/etc/shadow), private SSH keys (id_rsa), and environment variables containing credentials. - [COMMAND_EXECUTION]: It details procedures for achieving remote code execution (RCE) on targets through log poisoning and the exploitation of PHP wrappers such as
php://inputandexpect://. - [COMMAND_EXECUTION]: The instructions include the use of network-based fuzzing tools like
ffufandwfuzzto automate the discovery of vulnerabilities. - [PROMPT_INJECTION]: The skill processes untrusted data from external targets via tool outputs (e.g.,
curl,ffuf), which presents an indirect prompt injection surface if a target system responds with malicious instructions designed to influence the agent's behavior. - [COMMAND_EXECUTION]: Contains Base64-encoded executable code used in payloads (e.g.,
PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==which decodes to a PHP system command shell).
Audit Metadata