bug-bounty-methodology
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents numerous shell commands for target reconnaissance, subdomain enumeration, and vulnerability probing using common security industry tools.- [EXTERNAL_DOWNLOADS]: The workflow references third-party security utilities including subfinder, httpx, gau, katana, jsluice, and arjun, which are standard in the security community.- [PROMPT_INJECTION]: The skill describes processes for ingesting and analyzing untrusted data from external targets (e.g., JavaScript files and HTTP response bodies), which is a common surface for indirect prompt injection.
- Ingestion points: Content is fetched from user-defined target domains using curl and other tools in SKILL.md.
- Boundary markers: No specific boundary markers are used to isolate untrusted data from the agent context.
- Capability inventory: The methodology utilizes shell execution for networking, file handling, and data parsing.
- Sanitization: The skill focuses on manual analysis and does not include automated sanitization of fetched data.
Audit Metadata