skills/mukul975/anthropic-cybersecurity-skills/configuring-windows-event-logging-for-detection/Gen Agent Trust Hub
configuring-windows-event-logging-for-detection
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and accompanying Python scripts (
scripts/agent.py,scripts/process.py) use system commands such asauditpol,wevtutil,wecutil, andpowershellto query or modify Windows audit policies and event log configurations. - These commands are consistent with the skill's primary purpose of endpoint security hardening.
- Subprocess calls in the Python scripts use argument lists rather than shell strings, reducing the risk of command injection.
- [EXTERNAL_DOWNLOADS]: The skill references configuration templates and guidelines from trusted organizations and well-known services.
- It provides links to Palantir's GitHub repository for event forwarding configurations and SwiftOnSecurity's GitHub for Sysmon templates.
- It includes references to official documentation from Microsoft, NIST, MITRE, and SANS regarding logging standards.
Audit Metadata