web-vuln-oauth
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides bash scripts that use
curlto interact with OAuth/OIDC endpoints andpython3for JSON parsing and URL encoding. These tools are used legitimately to automate security testing workflows. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to the target application's authorization servers and OIDC discovery endpoints (e.g.,
/.well-known/openid-configuration). These requests are necessary to perform the security audit. - [SAFE]: The presence of an IDN homograph URL using a Cyrillic character ('а' in
аpp.example.com) is a functional test case for bypass detection and is explicitly documented as such. It does not indicate malicious obfuscation within the skill.
Audit Metadata