hunt-api-misconfig 監査レポート.

警告

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• SKILL.md includes JWT crypto attacks (alg:none, RS256→HS256 confusion) despite the description stating these are owned by hunt-jwt-crypto; this creates overlap and confusion about skill boundaries.
• The provided excerpt is truncated mid-sentence ('Use path traversal to move inside the server-s'), suggesting the file may be incomplete or the excerpt is cut off; a full SKILL.md should be verified.
• HTTP verb tampering section is brief and lacks a detailed hunt sequence compared to other sections.
• No explicit setup/installation instructions or prerequisites are provided for using the skill.
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

方法

このレポートは公開メタデータ、AI レビュー、リポジトリの鮮度、インストール準備、OpenAgentSkill イベント、品質スコア、信頼チェック、Agent セーフティゲートを統合します。完全なソースコード監査ではありません。