forensics-osquery
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSNO_CODEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate forensic workflows and SQL queries for system interrogation using osquery across Linux, macOS, and Windows platforms.
- [COMMAND_EXECUTION]: The skill requires execution of osqueryi and osqueryd command-line tools to collect system artifacts. This process typically requires root or administrator privileges, which is standard for forensic tools.
- [EXTERNAL_DOWNLOADS]: Installation steps reference official and trusted osquery distribution sites (e.g., pkg.osquery.io) and the official GitHub repository.
- [NO_CODE]: Several scripts referenced in the documentation as bundled resources, such as 'scripts/osquery_triage.sh', 'scripts/osquery_hunt.py', and 'scripts/parse_osquery_json.py', are absent from the provided skill package.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted system data from tables like processes and registry. Ingestion points: System tables in 'SKILL.md' and 'assets/forensic-packs/*.conf'. Boundary markers: None present. Capability inventory: 'osqueryi' and 'osqueryd' execution in 'SKILL.md'. Sanitization: No content filtering or validation is performed on the data retrieved from the system.
Audit Metadata