skills/mukul975/anthropic-cybersecurity-skills/performing-threat-hunting-with-elastic-siem/Gen Agent Trust Hub
performing-threat-hunting-with-elastic-siem
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted telemetry data from Elasticsearch indices, which serves as a potential surface for indirect prompt injection if an attacker crafts malicious log entries to influence the agent.
- Ingestion points: Data is fetched from
logs-endpoint.events.process-*andlogs-endpoint.events.*via thees.searchmethod inscripts/agent.py. - Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard potential instructions embedded within the retrieved log data.
- Capability inventory: The skill includes network read capabilities for Elasticsearch and provides documentation for network write operations via the Kibana detection engine API.
- Sanitization: Log fields such as
process.argsare output to the agent context without escaping or validation.
Audit Metadata