authenticated-session-acquisition
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a legitimate authentication workflow for security testing. It explicitly forbids hardcoding credentials or tokens, requiring them to be read from the environment or stored in specific output files (
storageState.json,bearer.txt) to avoid exposure in prompts or logs. - [SAFE]: MFA handling is implemented using standard RFC-6238 TOTP generation via a local script or manual operator input. It does not attempt to bypass or brute-force authentication mechanisms, which it explicitly defines as an out-of-scope activity for this specific skill.
- [SAFE]: The skill includes clear deferral logic for cases where credentials or access are unavailable, ensuring the testing state is accurately reported rather than faked or ignored.
- [SAFE]: References to external IdP providers (Auth0, Okta, Amazon Cognito, Descope) are for standard OIDC/OAuth2 integration flows required for the skill's stated purpose.
Audit Metadata