source-leak-hunt
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts and utilities such as curl, grep, xargs, and sed to automate reconnaissance tasks. The use of xargs to execute bash commands with external input represents a potential command injection surface if the input URL list is maliciously crafted.
- [CREDENTIALS_UNSAFE]: The skill contains logic specifically designed to extract sensitive information such as database passwords, API keys, and authentication tokens from exposed configuration files (e.g., .env, wp-config.php.bak) on target systems.
- [EXTERNAL_DOWNLOADS]: The documentation references external security tools including bfac, waybackurls, and httpx, which are expected to be available in the environment to perform extended discovery phases.
Audit Metadata