analyzing-active-directory-acl-abuse
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on its documented purpose of Active Directory security auditing. All operations, including LDAP connections and permission parsing, align with standard security diagnostic practices.- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'ldap3' library via pip. This is a well-known, legitimate library for LDAP communication in Python.- [COMMAND_EXECUTION]: The skill involves running a Python CLI script ('agent.py') which requires domain credentials provided by the user via command-line arguments. This is standard behavior for an auditing tool.- [DATA_EXFILTRATION]: The script reads security descriptors and object attributes from Active Directory. While this involves handling sensitive organizational data, the script only outputs findings to the console or a user-specified local file and does not transmit data to external third-party domains.- [PROMPT_INJECTION]: The script processes data ingested from Active Directory (e.g., 'sAMAccountName', 'distinguishedName'). 1. Ingestion points: Data is retrieved from Active Directory objects via LDAP searches in 'scripts/agent.py'. 2. Boundary markers: Not present; attributes are incorporated directly into the output report. 3. Capability inventory: The script has file-write capabilities ('--output' argument) and network access to the Domain Controller. 4. Sanitization: Attribute strings are retrieved directly; however, they are primarily used for reporting purposes rather than being executed as instructions.
Audit Metadata