22-purple-team
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the
detection_validator.pyscript for analyzing emulation results. The script uses the standard library to process JSON/YAML data and compute security metrics. Usage involves standard CLI command execution for data processing. - [INDIRECT_PROMPT_INJECTION]: The
detection_validator.pyscript ingests external data in JSON or YAML format. - Ingestion points: Data is loaded from files specified via the
--planand--baselinearguments inscripts/detection_validator.py. - Boundary markers: The script does not use explicit prompt delimiters but produces structured output for agent consumption.
- Capability inventory: The script performs file read and write operations based on user-provided command-line arguments.
- Sanitization: The
_normalize_entryfunction implements robust sanitization, including regex validation for ATT&CK technique IDs and strict type checking for all input fields (outcomes, booleans, and timestamps). - [EXTERNAL_DOWNLOADS]: The documentation references several well-known cybersecurity repositories and services, including MITRE ATT&CK, Atomic Red Team, DeTT&CT, and SIGMA. These references are for informational purposes or optional tool enhancement and target established industry organizations.
Audit Metadata