bug-bounty-methodology
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill automates a security testing workflow by executing various shell commands and specialized tools like subfinder, httpx, gau, katana, and arjun. The scripts employ double quoting for shell variables (e.g., "$TARGET") to safeguard against command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external targets via tools like gau and katana and reads remote file contents into the agent's context for analysis. While this untrusted data is processed without explicit boundary markers, the risk is managed through safe shell practices and is central to the skill's intended purpose.
- [EXTERNAL_DOWNLOADS]: The methodology involves extensive network interaction with the user-defined target domain using curl and other reconnaissance tools to gather information and test for vulnerabilities, including the download of remote JavaScript files for analysis.
Audit Metadata