artifact-collection
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to collect and preserve highly sensitive forensic artifacts from endpoints.
- Evidence:
- Accesses system registry hives (
collect_registry), which may contain sensitive configuration and password hashes. - Collects volatile memory dumps (
collect_memory), containing clear-text data from RAM. - Collects user home directory contents, specifically including SSH keys (
home.ssh_keys) and shell history (home.bash_history). - Performs remote data transfer of collected artifacts via
RemoteCollector. - Context: These actions are the core functionality of a forensic collection tool and are necessary for its intended use case.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests large volumes of untrusted data from the local or remote systems being investigated.
- Evidence:
- Ingestion points: System logs, process command lines (
proc.command_line), browser history, and file contents across multiple platforms (SKILL.md). - Capability inventory: The skill possesses file-write capabilities (generating reports and evidence packages) and network capabilities (remote collection and transfer).
- Sanitization: The instructions do not explicitly specify sanitization or boundary markers for the data being parsed before it is presented to the agent or included in reports.
- Risk: Maliciously crafted logs or process metadata on a compromised system could attempt to influence the agent's analysis or report generation.
Audit Metadata