skills/mukul975/anthropic-cybersecurity-skills/deploying-edr-agent-with-crowdstrike/Gen Agent Trust Hub
deploying-edr-agent-with-crowdstrike
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
crowdstrike-falconpypackage, which is the official and well-known SDK for interacting with the CrowdStrike Falcon platform. - [COMMAND_EXECUTION]: Instructions include the use of administrative commands such as
sudo,dpkg,yum, andscfor the installation and management of EDR sensors. These are expected and necessary for the skill's stated purpose of endpoint security deployment. - [INDIRECT_PROMPT_INJECTION]: The audit and verification scripts (
scripts/agent.pyandscripts/process.py) process data retrieved from external sources through the CrowdStrike API. - Ingestion points: Device details and detection summaries are ingested in
agent.pyandprocess.py. - Boundary markers: The output generated by these scripts lacks explicit markers or headers to distinguish between data and instructions for an observing agent.
- Capability inventory: The skill instructions include privileged command execution and file writing to the local system.
- Sanitization: There is no sanitization or validation of string data (e.g., hostnames, OS descriptions) received from the API before it is output to the console or files.
Audit Metadata