hunt-api-misconfig
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell commands using curl to perform network probing, version enumeration, and API testing against target infrastructure. It also includes instructions to run python3 -c commands for the dynamic execution of JWT generation logic and vulnerability testing.
- [REMOTE_CODE_EXECUTION]: The verification section demonstrates piping output from a network request to httpbin.org directly into the local python3 interpreter using the json.tool module for formatting. While used for data processing, this pattern involves feeding network-sourced data to a local interpreter.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to httpbin.org and various target paths to verify functionality and discover security misconfigurations.
- [PROMPT_INJECTION]: The skill lacks sanitization and boundary markers for data ingested from external APIs via curl. This creates a surface for indirect prompt injection where an attacker-controlled API could return content designed to influence the agent's behavior during data processing.
Audit Metadata