defense-dfir-triage
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a standard high-level methodology for Digital Forensics and Incident Response (DFIR). It mentions common tools such as Velociraptor, Chainsaw, and Hayabusa for analyzing host artifacts, but does not include any executable code, shell scripts, or automated installation procedures.
- [INDIRECT_PROMPT_INJECTION]: The forensic analysis process involves ingesting and parsing data from potentially compromised hosts (e.g., event logs, bash history, and memory artifacts) which are controlled by an attacker.
- Ingestion points: The skill instructs the agent to analyze external artifacts such as Windows event logs, Linux logs, and execution traces in SKILL.md.
- Boundary markers: There are no explicit instructions to use delimiters or warnings to ignore embedded instructions within the forensic data.
- Capability inventory: The methodology involves using external tools (chainsaw, hayabusa, velociraptor) to process untrusted data.
- Sanitization: No specific sanitization or escaping of the parsed log content is described.
Audit Metadata