hunt-brute-force
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is strictly documentation-based and does not include any executable scripts, automated tools, or hidden payloads. It provides a structured methodology for manual security assessments without bundling external dependencies.
- [SAFE]: Mandatory confirmation gates are implemented in SKILL.md, requiring the agent to verify target authorization, permitted scope, and exact command effects with the user before proceeding with any active probing.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for interacting with external web targets (e.g., OTP endpoints, login forms), which represents a potential surface for indirect prompt injection from target responses.
- Ingestion points: Server responses and status codes from target endpoints during OTP or enumeration testing (SKILL.md).
- Boundary markers: Explicit mandatory confirmation gates and instructions to remain read-only until explicit user approval is received.
- Capability inventory: None; the skill is 'docs-only' and contains no executable helper scripts or system-altering commands.
- Sanitization: Instructions require sanitizing semantic outcomes and keeping secrets out of command arguments and outputs.
Audit Metadata