subfinder
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the subfinder tool from the official ProjectDiscovery GitHub repository using standard Go installation or Docker methods.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes workflows that ingest data from external OSINT sources (e.g., DNS logs, search engines). This creates an attack surface where maliciously crafted subdomain data could attempt to influence the agent or downstream tools in the reconnaissance pipeline.\n
- Ingestion points: External passive OSINT sources including Shodan, Censys, and Certificate Transparency logs referenced in SKILL.md.\n
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the processing logic.\n
- Capability inventory: The skill uses tool chaining that includes file writing (-o), network enumeration, and vulnerability scanning (piping to nuclei).\n
- Sanitization: No explicit sanitization of discovered subdomain strings is documented before processing.
Audit Metadata