threat-hunter
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external data sources including threat intelligence reports, ISAC feeds, and SIEM telemetry (as detailed in
references/siem_query_and_telemetry.mdandreferences/threat_intel_and_attck_mapping.md). This creates an attack surface where malicious instructions could be embedded in the data logs or reports processed by the agent. - Ingestion points: System telemetry, external threat intelligence reports, and ISAC feeds.
- Boundary markers: No specific delimiters or instructions to ignore instructions within external data are provided in the skill guidelines.
- Capability inventory: The skill consists of Markdown documentation only and does not include internal scripts or direct tool calls, although it operates within the agent's general tool environment.
- Sanitization: The documentation recommends redacting PII for output reports but does not specify sanitization or escaping of untrusted input data.
- [NO_CODE]: The skill consists exclusively of Markdown documentation files. It does not contain any executable scripts, binaries, or instructions to install third-party packages.
Audit Metadata