analyzing-lnk-file-and-jump-list-artifacts
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured documentation for digital forensics using industry-standard tools (LECmd and JLECmd) and official Microsoft documentation.
- [SAFE]: The included Python code is a standard binary parser that extracts Shell Link header metadata using the struct module; it contains no networking, dynamic execution, or persistence mechanisms.
- [COMMAND_EXECUTION]: The skill provides PowerShell commands for running LECmd.exe and JLECmd.exe to analyze system artifacts. These commands are limited to local directory scanning and output generation consistent with the forensic scope.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an ingestion surface for untrusted Windows artifacts. Ingestion point: The
parse_lnk_headerfunction reads LNK files from the filesystem. Boundary markers: Not present. Capability inventory: The script is limited to binary file reading and metadata parsing. Sanitization: None, as the logic is intended for raw forensic data extraction.
Audit Metadata