recon-solar-installers
Fail
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill attempts to locate and extract sensitive information from target domains. It includes commands probing for .env files and grepping debug.log files for Social Security Numbers (SSN), credit scores, and financial details.
- [DATA_EXFILTRATION]: It extracts hardcoded API keys and tokens from client-side JavaScript files.
- [COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality, using curl to probe websites and python3 -c to process results.
- [REMOTE_CODE_EXECUTION]: The skill utilizes a pattern where data fetched from an external network source (crt.sh) is piped to a language interpreter. Evidence: curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3.
Recommendations
- HIGH: Downloads and executes remote code from: https://crt.sh/?q=%25.$TARGET&output=json - DO NOT USE without thorough review
Audit Metadata