hunting-evtx-with-chainsaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow provided in scripts/agent.py invokes Chainsaw with user-supplied parameters to hunt and search over a directory/file of .evtx artifacts (and can also load user-supplied --sigma/--mapping files), meaning outsider-authored event-log free text contained in those inputs is ingested at runtime without any prior selection/filtering step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes explicit install/runtime steps that fetch and build remote code (git clone + cargo build) from https://github.com/WithSecureLabs/chainsaw.git and also requires https://github.com/SigmaHQ/sigma.git, which are external repositories fetched at install/runtime and result in executing code from those URLs.