re-evasion
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends downloading analysis tools from official and well-known sources, including Microsoft Sysinternals (Procdump, Sysmon, Procmon) and Mandiant (SilkETW). It also suggests locating community mirrors for the AMSITrigger tool.
- [COMMAND_EXECUTION]: Instructs the use of several Windows diagnostic and analysis utilities via the command line, such as
procdump,logman,wpr, andGet-WinEvent, to perform memory analysis and monitor system event providers. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially malicious samples and their associated logs, which represents an attack surface for indirect prompt injection.
- Ingestion points: Malicious software samples and generated system logs as defined in the operational steps.
- Boundary markers: The instructions do not specify explicit delimiters for untrusted input data.
- Capability inventory: Shell command execution for system diagnostics, event tracing, and memory management.
- Sanitization: No specific data sanitization or validation steps are outlined for the processed inputs.
Audit Metadata