skills/mukul975/anthropic-cybersecurity-skills/parsing-artifacts-with-eric-zimmerman-tools/Gen Agent Trust Hub
parsing-artifacts-with-eric-zimmerman-tools
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent.pyuses thesubprocess.run()function to execute external Windows forensic binaries, such asMFTECmd.exe,PECmd.exe, andRECmd.exe. The command-line arguments for these tools are constructed using file paths and directories provided via the script's command-line interface (--collection,--out,--tools-dir). This behavior is consistent with the skill's stated purpose as a batch driver for forensic parsers. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdinstructions guide users to download and execute a PowerShell script (Get-ZimmermanTools.ps1) from a public GitHub repository managed by Eric Zimmerman. This script is used to install and maintain the forensic toolset required by the skill.
Audit Metadata