hashcat-crack

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands using hashcat, awk, and various Python utility scripts (GetUserSPNs.py, GetNPUsers.py) for hash extraction and password cracking.
  • [DATA_EXFILTRATION]: Instructions include a recommendation to query password hashes against third-party online databases such as hashes.org and crackstation.net for quick identification.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process data from external files (e.g., hashes.txt, secretsdump.txt, responder_hashes.txt) which are derived from environment-specific tool outputs.
  • Ingestion points: The skill reads hash data from external files specified in the command examples within SKILL.md.
  • Boundary markers: No specific delimiters or safety instructions are provided for handling the contents of the hash files.
  • Capability inventory: The skill utilizes local command-line tools including cat, awk, sort, and hashcat to process the contents of these files.
  • Sanitization: No input validation or sanitization steps are documented; the skill relies on the standard parsing behavior of the mentioned security tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:24 AM