dast-config
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to analyze security configuration files. It uses a restricted set of tools (Read, Grep, Glob) and does not have network access, which mitigates risks associated with data exfiltration or unauthorized external communication.- [PROMPT_INJECTION]: The skill identifies an 'Indirect Prompt Injection' assessment surface because it processes untrusted external DAST configuration files.
- Ingestion points: DAST configuration files (e.g., ZAP Automation Framework plans, Burp project files) and CI/CD workflow files (e.g., GitHub Actions, GitLab CI) located via Glob and Grep patterns.
- Boundary markers: The skill includes a dedicated 'Prompt Injection Safety Notice' section that explicitly warns the agent to treat all file content as untrusted data and ignore embedded instructions.
- Capability inventory: File access is restricted to the Read, Grep, and Glob tools as defined in the frontmatter. No subprocess execution, shell access, or network capabilities are enabled for this skill.
- Sanitization: The instructions provide specific guidance to the agent to disregard URLs, scan rule descriptions, or alert messages that might resemble instructions or commands during the assessment process.
Audit Metadata