cve-lookup
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches vulnerability data from the official NIST NVD API (
services.nvd.nist.gov), which is a trusted and well-known government service. - [COMMAND_EXECUTION]: The skill uses shell utilities to process data and includes a security validation step for the
CVE_IDusing regex. However, it employs unquoted shell heredocs (<< EOF) to write the report. This pattern allows the shell to evaluate and execute any command substitutions (such as$(...)or backticks) that might be present in the vulnerability descriptions fetched from the API. Using quoted heredocs (<< 'EOF') would mitigate this risk. - [SAFE]: The skill follows secure practices for credential management by using environment variables. It has an inherent surface for indirect prompt injection as it processes external vulnerability descriptions, which is documented here:
- Ingestion points: NIST NVD API response data processed in Step 3 and Step 4 of the workflow.
- Boundary markers: The output report is organized with clear section headers like
[ Description ]and[ CVSS Scores ]. - Capability inventory: Performs network requests (
curl), file writes (tee), and data parsing (jq). - Sanitization: Implements strict regex validation (
^CVE-[0-9]{4}-[0-9]{4,}$) for the primary user input parameter.
Audit Metadata