processing-stix-taxii-feeds
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access mechanisms were detected. The skill's behavior is consistent with its stated purpose of threat intelligence processing.
- [EXTERNAL_DOWNLOADS]: The skill is designed to connect to TAXII 2.1 servers to fetch intelligence bundles. This network activity is the primary function of the tool and uses the standard taxii2-client library for secure interaction with user-specified endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external intelligence feeds, which constitutes an ingestion surface. However, it implements schema validation through the stix2 library and does not execute the ingested content, limiting the risk associated with malicious data in the feeds.
- [CREDENTIALS_SAFE]: The script properly handles authentication by retrieving TAXII server credentials from environment variables (TAXII_USER and TAXII_PASSWORD) rather than hardcoding them, adhering to security best practices.
Audit Metadata