hunt-shadow-api
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell commands and loops using 'curl', 'jq', 'sort', and 'comm' to enumerate API versions, subdomains, and endpoints. These are standard reconnaissance tools consistent with the skill's stated purpose of offensive security testing.
- [EXTERNAL_DOWNLOADS]: Fetches archived API metadata and specification leads from the Wayback Machine (web.archive.org), which is a well-known service used for security research.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from API specifications and archive results. However, it incorporates a mandatory confirmation gate requiring the agent to ask the user for target details and authorization before performing any active probing, which mitigates the risk of unintended actions triggered by malicious external content.
Audit Metadata