recon-sector-expansion
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill queries crt.sh, a well-known certificate transparency search engine, to identify business domains. This is a standard and safe reconnaissance practice.
- [COMMAND_EXECUTION]: The Python script uses
subprocess.run(shell=True)to execute security tools likehttpx,curl, andnmap. While shell execution is used, the inputs are filtered through a strict regular expression ([A-Za-z0-9][A-Za-z0-9.-]*\.com) during the discovery phase, which significantly mitigates the risk of command injection from external data. - [SAFE]: Testing for CORS reflection using a header like
Origin: https://evil.comis a standard diagnostic procedure for identifying cross-origin vulnerabilities and does not constitute a security threat to the user.
Audit Metadata