opensearch-detection-engineer
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external OpenSearch indices and API outputs (such as mapping data, logs, and alert findings) as described in SKILL.md and references/detection-engineering.md. This content is processed to validate detection rules and build escalation packages.
- Ingestion points: OpenSearch API search results, index mappings, and detector findings referenced across all files.
- Boundary markers: Absent; instructions do not specify delimiters or guardrails for external data processed by the agent.
- Capability inventory: The skill has access to file system tools (Read, Write, Edit) and shell execution (Bash).
- Sanitization: The skill implements structural validation (e.g., field existence checks using GET mapping) but does not include explicit content sanitization for LLM prompt boundaries.
- [COMMAND_EXECUTION]: The skill provides numerous pre-defined shell commands (via the Bash tool) in references/detection-engineering.md and references/detection-safety-patterns.md to interact with OpenSearch clusters. These commands (e.g., POST /_plugins/_security_analytics/detectors, PUT /siem-chained-findings-queries) are correctly scoped to the intended SIEM management functionality and include safety checks to prevent cluster destabilization.
Audit Metadata