impacket-toolkit
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a reference to the official Impacket project repository on GitHub (github.com/fortra/impacket). This is an established and trusted source for security tools.
- [INDIRECT_PROMPT_INJECTION]: The skill provides documentation for tools that ingest data from external systems, which represents a potential attack surface. 1. Ingestion points: The agent ingests output from tools like secretsdump.py, smbclient.py, lookupsid.py, and rpcdump.py (specified in SKILL.md). 2. Boundary markers: None are defined to separate tool output from instructions. 3. Capability inventory: The documented tools allow for remote command execution (psexec.py, smbexec.py, wmiexec.py), network operations (ntlmrelayx.py), and file system access (smbclient.py) across all provided examples. 4. Sanitization: No validation or sanitization of the external command output is mentioned. This risk is inherent to the use of these tools for security auditing.
Audit Metadata