skills/mukul975/anthropic-cybersecurity-skills/detecting-golden-ticket-attacks-in-kerberos-logs/Gen Agent Trust Hub
detecting-golden-ticket-attacks-in-kerberos-logs
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by ingesting and parsing Windows Security Event Logs.
- Ingestion points: The script
scripts/agent.pyreads data from user-provided.evtxfiles to identify Kerberos anomalies. - Boundary markers: The script does not implement specific delimiters or instructions to ignore potential injection attempts within the log content.
- Capability inventory: The skill's capabilities are limited to local file reading and regex-based data extraction. It does not perform network operations, write to the file system, or execute arbitrary shell commands.
- Sanitization: Data extraction is restricted to specific XML tags using regex patterns, which limits the exposure to non-structured or malicious content within the logs.
Audit Metadata