payloads-api-key-leaks
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several well-known third-party security tools and repositories, including Trivy, TruffleHog, and Nuclei, for secret scanning.
- [DATA_EXFILTRATION]: It identifies sensitive configuration files and credentials, such as .env and .aws/credentials, as targets for security auditing and leak identification.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for analyzing untrusted external data sources, such as public repositories and logs, creating an attack surface for indirect prompt injection.
- Ingestion points: Source code, configuration files, Docker images, and logs as described in the methodology section.
- Boundary markers: The skill does not provide specific delimiters or instructions to ignore embedded content within the data being scanned.
- Capability inventory: References to CLI tools and network utilities for validating discovered secrets.
- Sanitization: No specific sanitization or filtering logic is provided within the skill for the data it targets.
Audit Metadata