defense-malware-triage
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is composed entirely of markdown instructions and lacks any executable scripts or automated commands that could be exploited.
- [NO_CODE]: No code or script files are present in the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for handling untrusted data (malware samples). Analysis of the attack surface indicates:
- Ingestion points: Suspicious files, processes, and documents provided for analysis as described in the methodology.
- Boundary markers: The instructions explicitly state to 'Handle safely' and work only in an isolated VM/network.
- Capability inventory: The skill leverages external analysis tools such as capa, yara, and floss via the agent's environment.
- Sanitization: Emphasizes the use of isolated environments to prevent production host impact and warns against uploading targeted samples to public scanners.
Audit Metadata