log-forensics
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive system log files, including Windows Security Event Logs (EVTX) and Linux Syslog, which contain detailed records of user activity, process executions, and system events. This access is the primary purpose of the forensic skill but represents high-privilege data access. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted log data from various sources that could be influenced by an attacker to include hidden instructions or malicious payloads designed to be interpreted by the AI agent. \n
- Ingestion points: Log files located in the evidence directory (e.g., /evidence/Security.evtx, /evidence/access.log, /evidence/messages). \n
- Boundary markers: No specific boundary markers or instructions to ignore embedded content were identified in the provided interface. \n
- Capability inventory: The skill possesses file read access, complex pattern matching for threat detection, and the ability to generate reports in CSV and HTML formats. \n
- Sanitization: While the tool detects specific attack patterns like SQL injection and path traversal within logs, it does not detail how the parsed data is sanitized before being passed to the agent context.
Audit Metadata