skills/terminalskills/skills/censys/Gen Agent Trust Hub

censys

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Installs the censys Python library via pip. This is the official software development kit (SDK) for the Censys search engine, a well-known service for internet research and security auditing.
  • [COMMAND_EXECUTION]: Executes shell commands for package installation and Python scripts for data retrieval. All commands are standard for the tool's intended purpose of infrastructure research.
  • [CREDENTIALS_UNSAFE]: The skill correctly implements secure credential management by instructing the user to use environment variables (CENSYS_API_ID, CENSYS_API_SECRET) and provides non-functional placeholders (YOUR_API_ID) rather than hardcoded secrets.
  • [PROMPT_INJECTION]: The skill processes external data retrieved from the Censys API, such as TLS certificate names and service banners. This represents a potential indirect prompt injection surface.
  • Ingestion points: Data enters the agent's context through h.search and h.view calls in SKILL.md.
  • Boundary markers: None present; data is printed to the console or written to files without specific delimiters.
  • Capability inventory: The skill has the capability to write local files using json.dump in the export_hosts_to_json function.
  • Sanitization: Service banners are truncated to 80 characters, which limits the volume of untrusted data processed, though no specific content sanitization is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 11:42 PM