skills/mukul975/anthropic-cybersecurity-skills/testing-for-sensitive-data-exposure/Gen Agent Trust Hub
testing-for-sensitive-data-exposure
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdfile contains bash command snippets utilizingcurl,grep, andjqto perform web reconnaissance and vulnerability scanning.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install well-known security tools, includingtrufflehog,gitleaks, andgit-dumper, from public registries and repositories.\n- [DATA_EXFILTRATION]: Theagent.pyscript specifically checks for the existence of sensitive files like.env,.git/config, and.aws/credentialson a remote target. This behavior is intentional and aligned with the skill's purpose for identifying improper data exposure on targets.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface where the agent processes untrusted remote data.\n - Ingestion points: Data is fetched from remote JavaScript files and API endpoints in
agent.py.\n - Boundary markers: No explicit markers are used to isolate untrusted data in the generated reports.\n
- Capability inventory: The script performs network requests and generates structured JSON reports.\n
- Sanitization: Content fetched from remote sources is processed via regex and included in reports without additional sanitization.\n- [SAFE]: The skill performs its stated tasks using standard libraries and transparent logic without any signs of obfuscation, persistence, or malicious intent.
Audit Metadata