authentication
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The reference documentation describes downloading the
ssh2john.pyscript from the Openwall GitHub repository, a well-known source for security tools, for the purpose of cracking SSH key passphrases. - [COMMAND_EXECUTION]: The skill provides numerous commands and scripts for security tools like
hydra,hashcat,mimikatz, andnxc(NetExec) to perform authentication testing during authorized assessments. - [OBFUSCATION]: The
phishing.mdreference guide includes examples of homoglyph-based domain names (e.g., using a Cyrillic character that resembles a Latin one) for the purpose of educating security testers on how homograph attacks work. - [INDIRECT_PROMPT_INJECTION]: As an authentication testing skill, it is designed to process and analyze potentially untrusted data such as session tokens, authentication headers, and server responses. The documentation includes scenarios for testing how systems handle manipulated inputs, which is the intended security testing purpose.
Recommendations
- CRITICAL: 2 file(s) identified as malware by FileRep - DO NOT USE
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata