skills/mukul975/anthropic-cybersecurity-skills/hunting-for-anomalous-powershell-execution/Gen Agent Trust Hub
hunting-for-anomalous-powershell-execution
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a dedicated security tool for threat hunting within Windows PowerShell logs. The Python script performs local analysis of provided .evtx files using standard libraries.
- [METADATA_POISONING]: A discrepancy exists between the author name in the skill metadata (mahipal) and the license file (mukul975). This is documented as a metadata consistency issue and does not represent a malicious attempt at deception.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Event Log files. (1) Ingestion point: agent.py processes .evtx files provided as CLI arguments. (2) Boundary markers: Absent. (3) Capability inventory: Local file reading, JSON report generation, and console output. (4) Sanitization: The script uses standard XML parsing via lxml to handle event data. Given the intended use for security analysis and the lack of high-risk capabilities like network access, the injection surface is considered safe.
Audit Metadata