skills/mukul975/anthropic-cybersecurity-skills/tracking-threat-actor-infrastructure/Gen Agent Trust Hub
tracking-threat-actor-infrastructure
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from internet-facing services, which provides a vulnerability surface for instructions embedded in external data.\n
- Ingestion points: The skill retrieves data from Shodan, VirusTotal, SecurityTrails, and crt.sh in
scripts/agent.pyandscripts/process.py.\n - Boundary markers: No delimiters or explicit instructions are provided to the agent to ignore potentially malicious content within the fetched data.\n
- Capability inventory: The skill performs network requests using the
requestslibrary and writes results to local JSON reports usingjson.dump.\n - Sanitization: No sanitization or filtering of the retrieved content is performed before processing.
- [EXTERNAL_DOWNLOADS]: The skill retrieves infrastructure information from well-known security services including Shodan, VirusTotal, and SecurityTrails.
- [COMMAND_EXECUTION]: The skill accepts user-supplied IP addresses and domains as input for performing network investigations and API queries.
Audit Metadata