iot-camera-recon
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes network tools including
masscan,curl, andffprobeto interact with remote cameras.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external network responses, creating a potential vulnerability surface.\n - Ingestion points: Data is ingested from
masscanJSON output andcurlHTTP response bodies (Axis configuration text and ONVIF SOAP XML) inSKILL.md.\n - Boundary markers: Absent; the skill does not use delimiters or specific instructions to isolate untrusted device data from its logic.\n
- Capability inventory: Includes capabilities for file system writing (
curl -o), network scanning (masscan), and data retrieval (curl).\n - Sanitization: Absent; data retrieved from remote devices is processed directly by shell utilities like
grep,cut, andtrwithout prior validation or escaping.
Audit Metadata