skills/mukul975/anthropic-cybersecurity-skills/detecting-dns-exfiltration-with-dns-query-analysis/Gen Agent Trust Hub
detecting-dns-exfiltration-with-dns-query-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted DNS log data (Zeek/Suricata) as part of its analysis workflow. While this ingestion of external data constitutes an attack surface, the potential for harm is negligible due to the tool's limited capabilities and primary security purpose.
- Ingestion points: DNS logs are processed from files read via the scripts/agent.py tool and the detector script provided in SKILL.md.
- Boundary markers: There are no explicit boundary markers or instructions to ignore embedded content within the analyzed logs.
- Capability inventory: The analysis tools are restricted to reading local log files and outputting statistical findings to the console. The skill does not perform network operations, local file writes, or command execution based on the log contents.
- Sanitization: Data is handled using standard string parsing, regular expressions, and JSON decoding.
Audit Metadata