skills/mukul975/anthropic-cybersecurity-skills/analyzing-windows-amcache-artifacts/Gen Agent Trust Hub
analyzing-windows-amcache-artifacts
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions recommend downloading forensic utilities like AmcacheParser from the developer's official GitHub-hosted site (ericzimmerman.github.io).
- [COMMAND_EXECUTION]: The workflow involves executing several external binaries and command-line tools, including kape.exe for data collection, AmcacheParser.exe for hive processing, and vt-cli for threat intelligence lookups.
- [INDIRECT_PROMPT_INJECTION]: The included agent.py script parses the Amcache.hve registry hive, which contains data that can be influenced by malicious software. This data is output without sanitization, presenting a surface for indirect prompt injection.
- Ingestion points: registry subkeys under Root\InventoryApplicationFile and Root\InventoryApplication in scripts/agent.py.
- Boundary markers: None implemented in the script output.
- Capability inventory: The script is restricted to file system reading and basic JSON output, with no network or subprocess execution capabilities.
- Sanitization: Registry values are extracted and printed without escaping or validation.
- [METADATA_POISONING]: There is a discrepancy between the author name 'mahipal' specified in the SKILL.md frontmatter and the license holder 'mukul975' listed in the LICENSE file.
Audit Metadata