s3-minio-content-type-xss
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlandpython3commands to perform network requests and test for header overrides. These are standard tools for security reconnaissance and do not exhibit malicious behavior in this context. - [REMOTE_CODE_EXECUTION]: The skill demonstrates how to generate a pre-signed S3 URL using the
boto3library in Python. This is a legitimate use of the library for security testing purposes and does not download or execute unauthorized code. - [PROMPT_INJECTION]: No evidence of prompt injection, role-play instructions, or safety filter bypass attempts were found.
- [DATA_EXFILTRATION]: No evidence of exfiltrating sensitive local data (e.g., SSH keys, AWS credentials) to external servers. The network operations are limited to testing target URLs for specific HTTP header behaviors.
- [OBFUSCATION]: The content is clear and uses standard technical terminology without hidden characters or encoded payloads.
Audit Metadata