recon-landscaping
Fail
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill employs a pattern where data retrieved from a network source is piped to a Python interpreter for processing.
- Evidence:
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "..."inSKILL.md. - Note: Although the Python code is static and used for JSON parsing, this pattern is frequently flagged as a security risk.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from
crt.shto perform certificate transparency-based subdomain enumeration. - Evidence:
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json"inSKILL.md. - [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands and utilities to perform reconnaissance and data probing.
- Evidence: Automated use of
curl,grep,exiftool, andsedto identify directory listings, check for sensitive files, and analyze image metadata. - [CREDENTIALS_UNSAFE]: The skill includes automated checks to identify and display sensitive credentials found in exposed log files.
- Evidence: Grep patterns targeting
DB_PASSWORD,DB_USER, andAPI_KEYwithin the/wp-content/debug.logfile.
Recommendations
- HIGH: Downloads and executes remote code from: https://crt.sh/?q=%25.$TARGET&output=json - DO NOT USE without thorough review
Audit Metadata