hunt-ldap
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses python3 -c for inline execution of code snippets to handle URL encoding, JSON escaping, and parsing of directory search results during the testing phases.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface. 1. Ingestion points: Responses from external target servers are captured using curl in Phase 1, 2, 3, 4, and 5. 2. Boundary markers: No delimiters or protective instructions are used to distinguish untrusted target data from agent instructions. 3. Capability inventory: The skill utilizes curl for network operations and python3 for local code execution. 4. Sanitization: No validation, filtering, or sanitization is performed on data retrieved from the targets before it is processed.
Audit Metadata