07-incident-response
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/evidence_collector.pyutility utilizessubprocess.runto execute a wide variety of system auditing tools (e.g.,ps,ss,lsof,netstat,wmic) for the purpose of collecting volatile forensic artifacts. - [DATA_EXFILTRATION]: The evidence collection script is designed to access and aggregate sensitive information, including
/etc/shadow(password hashes),/etc/sudoers, and user bash histories, into localized manifest files. This is a primary function for incident response but represents a significant sensitive data exposure risk if misused. - [PRIVILEGE_ESCALATION]: Documentation and scripts explicitly instruct the agent to run with root or administrator privileges, as many forensic commands and file paths are restricted.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation and use of various third-party forensic tools such as Volatility, Autopsy, and Velociraptor.
Audit Metadata