gobuster
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the gobuster CLI tool by providing shell command templates in SKILL.md. This allows the agent to perform network-based enumeration tasks using the shell.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where untrusted external data such as target URLs or wordlists is used to construct shell commands. \n
- Ingestion points: The Inputs section allows for the entry of URLs, hosts, domains, and wordlists (SKILL.md). \n
- Boundary markers: Absent. There are no instructions for the agent to use delimiters or sanitization routines for the input data. \n
- Capability inventory: The skill uses subprocess calls to execute gobuster subcommands like dir, dns, and vhost. \n
- Sanitization: Absent. The skill does not provide mechanisms for filtering or escaping special characters in the provided arguments before they are executed in the shell.
Audit Metadata