secops-hunt
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Considerations: The skill operates by ingesting telemetry such as process command lines and raw logs. This creates a surface where external data could potentially contain instructions aimed at the agent. While inherent to threat hunting, this pattern is addressed within the skill's instructions.
- Ingestion points: Data retrieved from event searches, including process command lines and raw log contents (described in SKILL.md).
- Boundary markers: The skill contains an explicit 'Prompt Injection Defense Directive' instructing the agent to treat all retrieved fields strictly as untrusted data rather than instructions.
- Capability inventory: Capabilities include structured event searching, entity summarization, and case management operations (commenting and updating cases).
- Sanitization: The skill relies on specific prompt-level directives to mitigate the risk of the agent obeying commands embedded within the analyzed log data.
Audit Metadata