offensive-osint
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from untrusted external environments (OSINT), creating an attack surface for indirect prompt injection attacks.
- Ingestion points: As described in
SKILL.md, the workflow gathers data from Certificate Transparency (CT) logs, DNS/ASN mapping, and public cloud asset enumeration. - Boundary markers: There are no defined delimiters or instructions provided to separate the untrusted OSINT data from the agent's instructions.
- Capability inventory: The skill documentation mentions integration with static and binary analysis tools (e.g.,
rg, AST parsers, decompilers) and the generation of remediation code. - Sanitization: No logic or procedures are specified to sanitize or validate the external data before it is processed by the AI agent.
- [NO_CODE]: The analyzed files consist of descriptive markdown documentation and metadata; no executable scripts, tool configurations, or binary files are included in the skill package.
Audit Metadata