recon-moving-companies
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches certificate transparency data from
crt.sh, a well-known public resource for domain research. - [EXTERNAL_DOWNLOADS]: Probes various endpoints and files on the user-defined
$TARGETdomain, such as/wp-json/and/wp-content/debug.log. - [COMMAND_EXECUTION]: Utilizes standard command-line tools including
curl,grep,jq, andteeto interact with targets and filter results. - [COMMAND_EXECUTION]: Executes hardcoded inline Python scripts (
python3 -c) to parse JSON output from remote targets. While this pattern was flagged by automated scanners, the Python code is local and used solely for data formatting rather than executing remote payloads. - [DATA_EXFILTRATION]: Focuses on identifying and retrieving customer Personal Identifiable Information (PII), such as moving dates and addresses, which may be exposed on vulnerable target websites.
- [PROMPT_INJECTION]: The skill processes untrusted data from external responses in its logic (e.g., Phase 1 and Phase 3). It lacks explicit boundary markers or sanitization beyond basic JSON parsing, creating a surface for indirect prompt injection common in reconnaissance tools.
Audit Metadata