skills/mukul975/anthropic-cybersecurity-skills/detecting-process-hollowing-technique/Gen Agent Trust Hub
detecting-process-hollowing-technique
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate cybersecurity tools and documentation for threat hunters. The Python scripts (
scripts/agent.py,scripts/process.py) are designed to analyze Sysmon and application logs for indicators of compromise (IoCs) associated with MITRE ATT&CK technique T1055.012. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external log data (EVTX, JSON, CSV) from potentially compromised systems, creating a surface for indirect prompt injection if an attacker crafts log entries to influence the agent's reasoning.
- Ingestion points: Log file paths provided to
scripts/agent.pyandscripts/process.py. - Boundary markers: None; the scripts process log entries as raw data.
- Capability inventory: The scripts are restricted to file reading and data extraction via regex and standard libraries. No high-risk capabilities such as
eval(),exec(), or network operations are present. - Sanitization: Content is extracted via regular expressions and structured into JSON/Markdown reports, which inherently limits the execution of embedded instructions.
Audit Metadata