analyzing-linux-audit-logs-for-intrusion
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/agent.py executes the ausearch system utility via subprocess.run. The command is constructed as a list of arguments, which is a secure practice that prevents shell injection attacks.
- [DATA_EXFILTRATION]: The skill accesses system log files (typically /var/log/audit/audit.log) to perform its intended forensic analysis. It allows saving results to a local file specified by the user but does not perform any network operations or transmit data externally.
- [PROMPT_INJECTION]: The skill ingests untrusted system log data in scripts/agent.py. While this presents a potential surface for indirect prompt injection if malicious log entries are crafted to influence an LLM, the risk is mitigated by structured parsing. Ingestion points: parse_audit_log in scripts/agent.py reads from /var/log/audit/audit.log. Boundary markers: None identified. Capability inventory: subprocess.run calls the ausearch binary in scripts/agent.py. Sanitization: The script uses regular expressions to parse and extract specific fields from the log data.
Audit Metadata