security-scanning-security-hardening
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because the
$ARGUMENTSvariable is directly embedded into prompts sent to subagents across all four phases without any sanitization or boundary markers (e.g., XML tags or explicit 'ignore' instructions). An attacker could provide input that overrides the instructions for the 'security-auditor' or 'backend-security-coder' agents. - Ingestion points: The
$ARGUMENTSvariable inSKILL.mdis passed to multiple subagents in Phase 1 (Scanning), Phase 2 (Remediation), Phase 3 (Controls), and Phase 4 (Validation). - Boundary markers: None present. The input is simply appended to the instructional string.
- Capability inventory: The skill coordinates subagents with capabilities to read the entire codebase (SAST), interact with the network (DAST/Pentest), write/modify source code (Remediation), and execute offensive security tools (Metasploit, Burp Suite).
- Sanitization: No escaping, filtering, or validation of
$ARGUMENTSis implemented before interpolation. - [COMMAND_EXECUTION]: The skill explicitly instructs subagents to utilize powerful and potentially destructive command-line tools. While intended for security validation, the capability to run tools like Metasploit, Burp Suite, and custom exploits via the
security-auditorsubagent represents a significant privilege level. - [DATA_EXFILTRATION]: The skill performs exhaustive information gathering, including secrets detection (GitLeaks, TruffleHog), SBOM generation, and architecture reviews. This sensitive metadata about the target application's vulnerabilities and infrastructure could be exfiltrated if the agent is compromised or redirected by an injection attack.
Audit Metadata