security-headers
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill encodes official security best practices from the OWASP Secure Headers Project and Next.js documentation. It guides users through inventorying and remediating response headers to mitigate common web vulnerabilities like XSS and clickjacking. Network operations are limited to auditing the application's own headers and utilizing reputable third-party auditing services.- [INDIRECT_PROMPT_INJECTION]: The skill defines a procedure for ingesting external data by analyzing the output of curl commands executed against user-provided URLs. This represents an attack surface for indirect prompt injection via malicious HTTP header values. However, the risk is mitigated as the agent is instructed to perform a deterministic classification task based on a static methodology rather than executing the ingested data.
- Ingestion points: Output from curl commands in Step 1 and Step 5 of the procedure.
- Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are defined for the curl output.
- Capability inventory: The skill is restricted to analyzing header strings and generating a remediation plan; it does not instruct the agent to write files or execute commands based on the analyzed values.
- Sanitization: No sanitization or validation of the external header content is specified before processing.
Audit Metadata