timeline-forensics
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process forensic artifacts from potentially compromised systems.
- Ingestion points: Disk images (
/evidence/disk.E01), memory dumps (/evidence/memory.raw), Windows Event Logs (Security.evtx), and PCAP network captures. - Capability inventory: The skill possesses file write capabilities (exporting CSV, JSON, and HTML reports) and extensive file read capabilities via forensic parsers.
- Sanitization: There is no evidence in the instructions regarding sanitization of content extracted from these artifacts. Malicious strings placed by an attacker in log entries or registry keys could influence the agent's behavior during analysis.
- [COMMAND_EXECUTION]: The skill provides instructions for high-privilege forensic operations.
- Evidence: Examples include parsing Master File Tables (MFT), registry hives (
SYSTEM,SOFTWARE,NTUSER.DAT), and system memory dumps, which involve deep inspection of forensic evidence containers.
Audit Metadata