hunt-ssrf
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSOBFUSCATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external target URLs, creating a surface for potential indirect prompt injection.
- Ingestion points: Target URLs provided during hunting (SKILL.md).
- Boundary markers: Includes a mandatory confirmation gate requiring explicit user authorization.
- Capability inventory: The skill is documentation-only and does not contain executable scripts.
- Sanitization: Methodology relies on manual out-of-band verification.
- [COMMAND_EXECUTION]: Documentation provides shell commands like curl and ffuf for manual security testing.
- [EXTERNAL_DOWNLOADS]: References external tools such as interactsh and research from HackerOne and PortSwigger.
- [OBFUSCATION]: Includes Base64-encoded URL examples (e.g., in references/details.md) to demonstrate filter bypasses.
Audit Metadata