scanning-tools

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions include numerous shell commands for network discovery, port scanning, and vulnerability assessment using tools like Nmap, Masscan, and Nikto in references/detailed-guide.md.- [PRIVILEGE_ESCALATION]: The guide uses sudo for administrative tasks such as starting services (systemctl), installing system packages (apt), and configuring network interfaces for wireless monitoring (airmon-ng) as seen in references/detailed-guide.md.- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where the agent processes untrusted data from external targets via scan results.
  • Ingestion points: Data enters the context through files like nmap_scan.xml during import or report generation steps in references/detailed-guide.md.
  • Boundary markers: Absent; there are no specific delimiters or instructions to ignore embedded content within the scan results.
  • Capability inventory: The skill has extensive command execution capabilities (Nmap, Burp, Metasploit, etc.) as detailed in references/detailed-guide.md.
  • Sanitization: Absent; the instructions do not specify sanitization or validation of the ingested scan data.- [EXTERNAL_DOWNLOADS]: The skill references standard package managers and registries to install security tools.
  • Fetches prowler and scoutsuite from PyPI using pip.
  • Installs openvas from the official repository using apt.
  • Uses the official owasp/zap2docker-stable image from Docker Hub.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 07:02 PM