re-forensics
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructional content for security professionals performing forensics and threat intelligence tasks. It references standard tools (such as Volatility, Ghidra, and IDA) and reputable services (such as VirusTotal, Any.run, and MISP) for their intended purposes.
- [NO_CODE]: The skill is documentation-only and does not include any executable scripts, compiled binaries, or dynamic context injection patterns such as the exclamation-backtick command syntax.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for analyzing untrusted forensic artifacts. While this represents a data ingestion surface, the risk is managed through manual analysis steps rather than automated execution.
- Ingestion points: Ingests memory dumps (.raw, .mem, .core), container image archives, and external threat indicators (hashes, IPs, domains) as described in the Selection Tree.
- Boundary markers: The instructions do not specify automated delimiters; analysis is directed to be conducted using external forensic tools.
- Capability inventory: The skill utilizes memory-forensics, threat-intel, and decompilation capabilities to analyze the provided data.
- Sanitization: The skill relies on standard forensic procedures and professional tools rather than automated agent-side sanitization.
Audit Metadata