defense-dfir-triage
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill documentation is purely informational, providing guidelines for security professionals on how to conduct forensic triage. It does not contain any executable scripts, command snippets, or automation logic.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a process that involves ingesting data from potentially compromised systems (logs, memory, persistence artifacts). While analyzing such data inherently carries a risk of indirect prompt injection if automated by an agent, this skill only provides the methodology and lacks any implementation code that would process this data.
- Ingestion points: The methodology suggests analyzing Windows Event Logs, Linux auth logs, and filesystem artifacts (Prefetch, Shimcache, etc.).
- Boundary markers: None provided, as this is a high-level manual methodology.
- Capability inventory: No tools are invoked or scripted; the skill only lists recommended third-party software like Velociraptor and Hayabusa.
- Sanitization: Not applicable as no data processing is implemented.
Audit Metadata