security-detection-rule-management
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious behavior, obfuscation, or safety bypass attempts were detected. The skill is authored by a trusted vendor (elastic) and performs legitimate SOC management tasks.
- [EXTERNAL_DOWNLOADS]: The
fetch-endpoint-rule-from-github.jsscript retrieves rule definitions from the official and trusted 'elastic/protections-artifacts' GitHub repository. This is an expected operation for understanding rule logic during tuning. - [COMMAND_EXECUTION]: The skill uses Node.js scripts to facilitate API requests. These scripts implement protective measures, including confirmation prompts for all write operations and local syntax validation for KQL, EQL, and ES|QL queries to prevent accidental misconfigurations.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with security alert data which could contain untrusted strings. However, it mitigates this surface by using structured JSON communications and specific instructions for the agent to report tool output faithfully, minimizing the likelihood of malicious data influencing agent behavior.
Audit Metadata