skills/mukul975/anthropic-cybersecurity-skills/hunting-for-lolbins-execution-in-endpoint-logs/Gen Agent Trust Hub
hunting-for-lolbins-execution-in-endpoint-logs
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external endpoint logs in CSV, EVTX, and JSON formats which could contain attacker-controlled strings like command line arguments. These are extracted and presented to the agent without sanitization or explicit boundary markers, creating a surface where malicious instructions in logs could influence the agent's behavior. Evidence includes ingestion points in
scripts/agent.py(scan_csv_logs, scan_evtx_sysmon) andscripts/process.py(parse_events), the capability to display log contents, and the absence of sanitization. - [METADATA_POISONING]: The author name listed in
SKILL.mdis 'mahipal', while theLICENSEfile and system context identify the author as 'mukul975'. This inconsistency in metadata is deceptive regarding the skill's origin.
Audit Metadata