hunt-ntlm-info
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a specific
curlcommand template designed to probe external target servers for NTLM authentication headers. This command uses a generic, anonymous NTLM Type-1 message to trigger a server response. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect injection as it ingests user-provided target URLs for processing. To mitigate this, the instructions include a mandatory multi-step confirmation gate that requires the agent to verify written authorization and scope with the user before performing any active network operations.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill involves network operations (via
curl) to external domains provided by the user. While intended for reconnaissance, this capability allows the agent to interact with arbitrary internet-reachable endpoints.
Audit Metadata