detection-engineering
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes a dedicated 'Prompt Injection Safety Notice' in Section 8. This section provides proactive instructions to the agent to treat any embedded directives within analyzed content (such as 'ignore previous instructions' found in logs or reports) as data rather than commands. This hardening effectively mitigates risks from indirect prompt injection.
- [EXTERNAL_DOWNLOADS]: All external URL references target well-known and trusted technology or security domains, including mitre.org, sigmahq.io, github.com/redcanaryco, microsoft.com, and palantir.com. These are used for documentation and framework reference and do not involve untrusted code execution.
- [COMMAND_EXECUTION]: While the skill contains shell command examples (e.g., PowerShell commands with encoded arguments), these are strictly for documentation of detection logic and analyst validation procedures. The skill does not instruct the agent to execute these commands. Furthermore, the safety notice in Section 8 explicitly forbids the agent from executing any commands found within user-supplied samples.
- [DATA_EXFILTRATION]: The skill includes instructions to maintain data privacy by redacting or generalizing sensitive values such as IP addresses, internal hostnames, and usernames found in production logs before including them in output.
Audit Metadata