skills/mukul975/anthropic-cybersecurity-skills/implementing-siem-use-cases-for-detection/Gen Agent Trust Hub
implementing-siem-use-cases-for-detection
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Step 4 in SKILL.md provides a command to download and execute a PowerShell script directly from a remote URL using the Invoke-Expression (IEX) command. The source URL (https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1) belongs to the official Red Canary repository.
- [EXTERNAL_DOWNLOADS]: The skill guides the installation of the Atomic Red Team framework and the 'attackcti' library, which fetches threat intelligence data from MITRE's public repositories.
- [COMMAND_EXECUTION]: The workflow involves executing shell commands in PowerShell and Bash to install software and run attack simulations (e.g., Invoke-AtomicTest) for detection validation.
- [INDIRECT_PROMPT_INJECTION]: The skill includes logic to process an external 'enterprise-attack.json' file for technique mapping, which constitutes an attack surface.
- Ingestion points: Local 'enterprise-attack.json' file processed in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Shell command execution and Python script execution.
- Sanitization: The implementation uses structured JSON parsing to extract specific technique identifiers rather than executing content.
Audit Metadata