zombie-brute
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
zombiecommand-line tool, which is a powerful security auditing utility. It includes examples for performing multi-protocol brute-forcing (SSH, RDP, MySQL, Redis, etc.), subnet scanning (e.g.,10.0.0.0/24), and credential spraying across network services. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by ingesting external data sources. Specifically, the tool processes target lists (
-l targets.txt), user lists (-U users.txt), and password dictionaries (-P passwords.txt). If these files are sourced from untrusted environments, they could potentially contain malicious content aimed at influencing the agent's behavior or the command execution context. No explicit boundary markers or sanitization instructions are provided to mitigate this risk.
Audit Metadata