censys
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
censysPython library via pip. This is the official software development kit (SDK) for the Censys search engine, a well-known service for internet research and security auditing. - [COMMAND_EXECUTION]: Executes shell commands for package installation and Python scripts for data retrieval. All commands are standard for the tool's intended purpose of infrastructure research.
- [CREDENTIALS_UNSAFE]: The skill correctly implements secure credential management by instructing the user to use environment variables (
CENSYS_API_ID,CENSYS_API_SECRET) and provides non-functional placeholders (YOUR_API_ID) rather than hardcoded secrets. - [PROMPT_INJECTION]: The skill processes external data retrieved from the Censys API, such as TLS certificate names and service banners. This represents a potential indirect prompt injection surface.
- Ingestion points: Data enters the agent's context through
h.searchandh.viewcalls inSKILL.md. - Boundary markers: None present; data is printed to the console or written to files without specific delimiters.
- Capability inventory: The skill has the capability to write local files using
json.dumpin theexport_hosts_to_jsonfunction. - Sanitization: Service banners are truncated to 80 characters, which limits the volume of untrusted data processed, though no specific content sanitization is performed.
Audit Metadata