skills/mukul975/anthropic-cybersecurity-skills/detecting-command-and-control-over-dns/Gen Agent Trust Hub
detecting-command-and-control-over-dns
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script 'scripts/agent.py' utilizes 'pickle.load()' to deserialize machine learning models from a user-specified file path. This is a known unsafe deserialization pattern as it allows for the execution of arbitrary Python code stored within the pickle file. An attacker could provide a malicious model file to achieve code execution on the system running the analysis.
- [COMMAND_EXECUTION]: The 'SKILL.md' file provides several shell command examples for processing and filtering DNS logs. These commands use standard system utilities including 'cat', 'grep', 'awk', 'jq', 'zeek-cut', and 'tshark' to parse network telemetry locally.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several well-known and standard third-party Python packages for data analysis and network forensics. These dependencies include 'numpy', 'scikit-learn', 'pandas', 'tldextract', and 'dnspython', all of which are sourced from official package registries.
Audit Metadata