skills/mukul975/anthropic-cybersecurity-skills/detecting-insider-threat-with-ueba/Gen Agent Trust Hub
detecting-insider-threat-with-ueba
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent.pyperforms network operations and data processing that interact with infrastructure. - In
scripts/agent.py, theconnect_esfunction explicitly setsverify_certs=False. This disables SSL/TLS certificate verification when connecting to the Elasticsearch cluster. While often used for self-signed certificates in local environments, this practice makes the connection vulnerable to Man-in-the-Middle (MitM) attacks, potentially allowing an attacker to intercept API keys and sensitive security log data. - [METADATA_POISONING]: There is a discrepancy in the authorship information provided in the skill files.
- The
SKILL.mdfrontmatter identifies the author asmahipal, while theLICENSEfile and prompt context attribute the work tomukul975. - Mismatched metadata can indicate deceptive packaging or poor supply chain hygiene, making it harder to verify the origin and safety of the skill.
Audit Metadata