skills/mukul975/anthropic-cybersecurity-skills/performing-cryptographic-audit-of-application/Gen Agent Trust Hub
performing-cryptographic-audit-of-application
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted data from local source files and configurations.
- Ingestion points: Source code and configuration files are read in 'scripts/agent.py' and 'scripts/process.py'.
- Boundary markers: Absent; the tool reads file content directly without delimiters or instructions for the agent to ignore embedded commands.
- Capability inventory: Includes file system reading, remote TLS endpoint inspection, and report generation.
- Sanitization: Secret redaction is performed in 'scripts/process.py', but general code content is not sanitized before being included in findings.
- [DATA_EXFILTRATION]: The skill performs network operations to audit TLS endpoints in 'scripts/agent.py' and 'references/api-reference.md'. This involves establishing connections to user-specified hosts to evaluate certificate and protocol security.
- [COMMAND_EXECUTION]: The skill executes file system operations to recursively scan directories and read individual files for cryptographic pattern matching.
- [SAFE]: The tool follows security best practices for its intended domain, such as using 'ssl.create_default_context()' for secure connections and providing clear remediation advice based on NIST and OWASP standards.
Audit Metadata