agency-threat-detection-engineer
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a technical guide for security operations, focusing on detection rule development and lifecycle management.
- [DATA_EXFILTRATION]: The technical templates provided include examples of pushing rules to external services (e.g., Splunk, Microsoft Sentinel) using secure secret management via GitHub Actions variables, which is a recommended security practice.
- [PROMPT_INJECTION]: The skill includes instructions to ingest and analyze untrusted data (logs, threat intelligence), which is a functional requirement for the role but represents an indirect prompt injection surface. 1. Ingestion points: User-provided log files, Sigma rules, and threat intelligence reports mentioned in SKILL.md. 2. Boundary markers: None explicitly defined to separate data from instructions. 3. Capability inventory: Text generation of SIEM queries (Splunk SPL, KQL, EQL). 4. Sanitization: The skill does not provide specific instructions for sanitizing external data before analysis.
Audit Metadata