unauth-api-flow-hijack
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlandpython3commands to probe API endpoints, submit data, and process JSON responses. These are standard tools for security testing and are used as intended for the skill's primary purpose of API vulnerability assessment. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://target.com(a placeholder for the user-specified target) to test for insecure API endpoints. These requests are part of the core functionality for identifying security gaps in multi-step workflows. - [REMOTE_CODE_EXECUTION]: The skill includes Python scripts that use the
requestslibrary to interact with remote APIs. This code is contained within the skill and does not download or execute arbitrary code from untrusted third-party sources.
Audit Metadata