iblai-vibe-security-disk-forensics
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute various forensic analysis commands. Evidence includes templates for partition layout identification (fdisk, mmls), read-only mounting (mount -o ro,loop), and file system extraction via The Sleuth Kit (fsstat, fls, icat). It also utilizes artifact recovery and metadata tools such as binwalk, foremost, exiftool, and bulk_extractor.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from disk images and file systems, creating a surface for indirect prompt injection. 1. Ingestion points: Forensics evidence images, system logs (/var/log/*), browser history (e.g., ~/.mozilla), and Windows Registry hives. 2. Boundary markers: The skill includes explicit directives to 'Work only on provided images' and 'Never modify evidence,' which serve as boundary constraints. 3. Capability inventory: The skill has access to Bash, Read, Write, and Grep tools to perform data analysis and reporting. 4. Sanitization: The skill does not explicitly describe sanitization or filtering mechanisms for the data content extracted from the images before the agent processes it.
Audit Metadata