tls-fingerprint-impersonation
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'impit' library from public package registries (PyPI and NPM) to enable TLS fingerprint spoofing functionality.\n- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by interpolating potentially untrusted external data into network request functions in SKILL.md.\n
- Ingestion points: The 'target_url' parameter in 'impit.get()' and the 'headers' dictionary in Phase 4 are entry points where external data is ingested.\n
- Boundary markers: No boundary markers or 'ignore' instructions are used to delimit external data from the skill's instructions.\n
- Capability inventory: The skill possesses significant network capabilities including GET and POST requests, persistent cookie storage, and proxy support.\n
- Sanitization: The provided instructions do not include any steps for sanitizing, validating, or escaping the external content before it is processed in network operations.
Audit Metadata