web-vuln-http-smuggling
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands by interpolating user-provided variables like $TARGET_HOST and $AUTH_HEADER directly into curl strings within SKILL.md. This pattern is vulnerable to command injection if the input variables are not properly sanitized.
- [CREDENTIALS_UNSAFE]: The skill explicitly accepts an AUTH_HEADER input variable for authentication tokens. These credentials are passed as command-line arguments to curl, which can lead to exposure in system process lists or shell history.
- [DATA_EXPOSURE_AND_EXFILTRATION]: Workflow steps in SKILL.md write target server responses to temporary files in the /tmp/ directory (e.g., /tmp/clte_response.txt). In multi-user environments, these world-readable files could expose sensitive application data retrieved during testing.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing and displaying raw data from external target servers.
- Ingestion points: Target HTTP response headers and bodies are retrieved via curl in SKILL.md (Steps 1, 2, 3, 5, and 6) and stored in temporary files.
- Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to disregard potentially malicious content embedded in the target responses.
- Capability inventory: The skill environment allows for network requests (curl) and shell command execution, which could be abused if an agent obeys instructions contained in a malicious server response.
- Sanitization: There is no evidence of sanitization or filtering of the content fetched from target servers before it is displayed or processed (e.g., cat /tmp/h2cl_response.txt).
Audit Metadata