skills/mukul975/anthropic-cybersecurity-skills/performing-web-application-vulnerability-triage/Gen Agent Trust Hub
performing-web-application-vulnerability-triage
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The triage script ingests vulnerability scan results from external sources. If an attacker can manipulate these results, they could inject malicious instructions into the triage report.\n
- Ingestion points: The
scripts/agent.pyscript reads finding data (titles, descriptions, URLs) from JSON files provided by the user via command-line arguments.\n - Boundary markers: The script does not use any delimiters or warnings to prevent the agent from obeying instructions embedded in the findings.\n
- Capability inventory: The script's primary functions are data deduplication and prioritization; no dangerous capabilities like network access or subprocess execution were found in the code.\n
- Sanitization: There is no sanitization or escaping of the ingested data beyond simple length truncation.
Audit Metadata