skills/mukul975/anthropic-cybersecurity-skills/analyzing-malware-persistence-with-autoruns/Gen Agent Trust Hub
analyzing-malware-persistence-with-autoruns
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains a Python script in SKILL.md that uses the
subprocessmodule to executeautorunsc64.exe. This is a legitimate use of the Windows Sysinternals Autoruns utility to collect system autostart data for security triaging. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes data from CSV files (either generated at runtime or provided by the user). This represents a vulnerability surface where maliciously crafted system entries (e.g., a file with a name containing instructions) could attempt to influence the agent's interpretation, though this is a standard risk for forensic analysis tools.
- Ingestion points: CSV parsing logic in
scripts/agent.pyandSKILL.mdusingcsv.DictReader. - Boundary markers: None identified in the prompt logic.
- Capability inventory: Local file writing (
scan.csv,autoruns_report.json) and command execution (subprocess.run). - Sanitization: None; the scripts perform direct string matching and regex searches on the input data.
Audit Metadata