detecting-shadow-it-cloud-usage
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements its stated purpose of identifying 'Shadow IT' cloud usage by parsing proxy, DNS, and firewall logs using standard Python libraries like pandas and re.
- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known Python packages pandas and tldextract. tldextract may occasionally fetch the Public Suffix List from standard sources to maintain domain extraction accuracy, which is a routine and safe operation for this library.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (network logs).
- Ingestion points: The log_file processed by parsing functions in scripts/agent.py.
- Boundary markers: None identified in the generated JSON report output.
- Capability inventory: The script performs local file reading and outputs analysis results to standard output; no network write or code execution capabilities are present.
- Sanitization: Inputs are validated against regular expression patterns during parsing.
Audit Metadata