skills/mukul975/anthropic-cybersecurity-skills/hunting-for-unusual-network-connections/Gen Agent Trust Hub
hunting-for-unusual-network-connections
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [SAFE]: The skill consists of standard threat hunting documentation, queries for common security platforms (Splunk, MDE), and Python scripts for offline log analysis. The logic is transparent and focuses on legitimate anomaly detection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted network logs to generate markdown reports, which creates a potential surface for instruction injection if the reports are processed by other agents.
- Ingestion points:
scripts/agent.pyandscripts/process.pyingest user-provided JSON/CSV log files. - Boundary markers: The generated markdown reports do not include explicit delimiters or "ignore instructions" warnings for the extracted log content.
- Capability inventory: The scripts possess file system read and write capabilities but do not perform network operations or dynamic code execution.
- Sanitization:
scripts/process.pytruncates command line strings to 500 characters, but no specific sanitization of markdown control characters is performed on the extracted data. - [METADATA_POISONING]: There is a minor naming inconsistency between the author field in the skill metadata ('mahipal') and the copyright holder in the Apache License ('mukul975'). This is likely a documentation error and does not impact the operational safety of the skill.
Audit Metadata