recon-mattress-stores
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands that reference a
$TARGETvariable. This is the intended behavior for a reconnaissance tool, allowing an agent to scan domains provided by the user. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto interact with public-facing endpoints of the mattress store targets. These operations are restricted to retrieving configuration data (e.g., Shopify products.json) and checking HTTP headers. - [DATA_EXFILTRATION]: The skill includes patterns to discover potentially sensitive data exposed on the target's own infrastructure, such as internal manager emails in store locators or exposed public API keys. This does not involve exfiltrating the agent's internal state or user credentials.
- [REMOTE_CODE_EXECUTION]: The automated scanner's alert regarding remote code execution appears to be a false positive. The scanner likely misidentified the string 'sh' within a 'grep' command (targeting 'shopify' headers) as a shell pipe execution.
Audit Metadata