skills/mukul975/anthropic-cybersecurity-skills/hunting-for-data-exfiltration-indicators/Gen Agent Trust Hub
hunting-for-data-exfiltration-indicators
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Technical review of
scripts/agent.pyandscripts/process.pyconfirms they are legitimate utilities for parsing network telemetry logs (CSV, TSV, and JSON formats). The scripts calculate statistical indicators like Shannon entropy for DNS queries and aggregate outbound byte counts per host to identify anomalies. They do not perform external network requests or access sensitive system credentials. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data through the processing of network logs, specifically DNS query strings and destination domains. This is the primary intended function of the threat-hunting tool. The scripts handle this data as input for statistical models (entropy and volume analysis) rather than as executable instructions or direct prompt context, minimizing the risk of accidental command execution or agent behavior manipulation.
Audit Metadata