smtp-penetration-testing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute several powerful security and networking tools including Nmap, Hydra, Netcat, Medusa, and the Metasploit Framework to perform network scans, banner grabbing, and security testing.
- [PRIVILEGE_ESCALATION]: The skill requires the use of 'sudo' to install necessary security tools via the system package manager (apt-get), which grants the agent the ability to execute commands with administrative privileges during the setup phase.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external SMTP servers and processes their responses (e.g., banners and command results). This creates an attack surface where a malicious or compromised server could return crafted data to influence the agent's behavior.
- Ingestion points: SMTP server banners and response codes during Phase 3, 4, and 6.
- Boundary markers: None identified for delimiting server responses from instructions.
- Capability inventory: Subprocess execution for nmap, hydra, msfconsole, medusa, dig, and openssl.
- Sanitization: No explicit sanitization or validation of server responses is documented before the data is processed or displayed.
Audit Metadata