profiling-threat-actor-groups
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/agent.pydownloads the MITRE ATT&CK Enterprise STIX bundle fromhttps://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json. This is a well-known, authoritative source for cybersecurity threat intelligence data. - [COMMAND_EXECUTION]: The skill provides examples of running a local Python script (
agent.py) to process the downloaded threat data. The execution is limited to local data processing and does not involve risky shell operations or untrusted input execution. - [DATA_EXFILTRATION]: There is no evidence of sensitive data access or transmission to untrusted domains. The only network operation is the retrieval of the MITRE STIX data.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external threat intelligence data (STIX objects), it does so using structured parsing (stix2 library) for local profiling. It does not interpolate this data into agent prompts in a way that suggests a vulnerability to instruction injection.
Audit Metadata