skills/mukul975/anthropic-cybersecurity-skills/evaluating-threat-intelligence-platforms/Gen Agent Trust Hub
evaluating-threat-intelligence-platforms
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script 'scripts/agent.py' handles sensitive API keys for MISP and OpenCTI.
- Evidence: The functions 'test_misp_api' and 'test_opencti_api' take 'api_key' and 'api_token' parameters which are retrieved from environment variables or command-line arguments.
- Evidence: Passing API keys as command-line arguments (sys.argv) is insecure as they can be exposed in process logs, shell history, and process management tools.
- [EXTERNAL_DOWNLOADS]: The diagnostic script performs outbound network requests with insecure configurations.
- Evidence: The 'test_misp_api' and 'test_opencti_api' functions utilize 'urllib.request.urlopen' to connect to user-provided URLs.
- Evidence: Both functions default to 'verify_ssl=False', which explicitly disables SSL certificate validation by setting 'ctx.check_hostname = False' and 'ctx.verify_mode = ssl.CERT_NONE'.
- Evidence: The CLI implementation in the 'main' block does not provide a mechanism to toggle SSL verification, forcing users into an insecure connection that is vulnerable to Man-in-the-Middle (MitM) attacks.
- [DATA_EXFILTRATION]: The connectivity tests are designed to transmit credentials to external endpoints.
- Evidence: The provided API keys are automatically included in the 'Authorization' header of HTTP requests directed at URLs specified by the user. If a user is tricked into providing a malicious URL, their API credentials will be exfiltrated to that destination.
Audit Metadata