06-threat-hunting
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides defensive security capabilities, including indicator extraction and MITRE ATT&CK mapping, which align with its stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill requires standard Python security libraries including
requests,pyyaml,stix2, andtaxii2-client. These are well-known packages used for handling threat intelligence data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from threat reports and emails (e.g., in
scripts/ioc_extractor.py). It mitigates this risk by including explicit instructions to treat all processed content as evidence rather than instructions, and it uses regex-based extraction to minimize the impact of embedded malicious commands. - [COMMAND_EXECUTION]: The skill provides CLI scripts (
ioc_extractor.py,mitre_mapper.py) that perform local file operations and data processing, which are appropriate for its intended use case.
Audit Metadata