cyber-threat-hunting
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions establish a highly disciplined environment for threat hunting. It mandates that any active collection or network operations require specific authorization, a documented scope, and runtime-proven controls. These internal guardrails significantly reduce the risk of unauthorized or harmful actions.
- [EXTERNAL_DOWNLOADS]: The skill references authoritative resources from well-known organizations, specifically MITRE ATT&CK data sources and NIST SP 800-86 guidelines for evidence handling. These are standard industry references and are considered safe.
- [INDIRECT_PROMPT_INJECTION]: While the skill is designed to process external datasets (telemetry, endpoint events), it includes specific instructions to normalize data without overwriting originals and to bound all conclusions strictly to the examined evidence. These practices mitigate the risk of malicious instructions within processed data influencing the agent's behavior or conclusions.
- [COMMAND_EXECUTION]: The skill documentation and evaluation cases emphasize that the agent should not perform live queries or data collection without explicit authorization and engagement references, favoring offline analysis of authorized fixtures.
Audit Metadata