soc-analyst
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external security platforms (SIEM, EDR, cloud providers) during the alert triage process.\n
- Ingestion points: Alerts and logs from SIEM, EDR, email, and identity providers as specified in
SKILL.mdandreferences/alert_triage_and_classification.md.\n - Boundary markers: The provided guidelines do not define specific delimiters to separate external log content from the agent's operational instructions.\n
- Capability inventory: The skill guides the agent through investigation steps, IOC enrichment, and recommending containment actions across enterprise security tools.\n
- Sanitization: The documentation lacks instructions for sanitizing or escaping untrusted external telemetry data processed during analysis.
Audit Metadata