recon-gyms
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard utilities including
curl,grep,jq, andsedto perform network reconnaissance, header analysis, and response parsing on user-provided target domains. - [EXTERNAL_DOWNLOADS]: Fetches data from external target websites and well-known fitness service providers (e.g.,
mindbodyonline.com,marianatek.com,clubready.com) to fingerprint platforms and verify API endpoints. - [PROMPT_INJECTION]: The skill processes untrusted content retrieved from target websites, creating a potential surface for indirect prompt injection.
- Ingestion points: Responses from
curlcommands targeting$TARGETand platform-specific APIs across all steps inSKILL.md. - Boundary markers: Absent; the skill does not instruct the agent to use specific delimiters or ignore embedded instructions when interpreting target responses.
- Capability inventory: Shell execution of
curl,grep,jq, andsedto interact with network services and local data. - Sanitization: No explicit sanitization or validation of the fetched HTML or JSON content is performed prior to agent processing.
Audit Metadata