windows-hardening
Warn
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses multiple PowerShell and command-line tools (net, secedit, auditpol, wecutil) to reconfigure system security settings and export sensitive audit data.\n- [EXTERNAL_DOWNLOADS]: Fetches and installs PowerShell modules (SecurityPolicyDsc, AuditPolicyDsc, PSDesiredStateConfiguration) and provides instructions to download the Microsoft Security Compliance Toolkit from an official source.\n- [PRIVILEGE_ESCALATION]: Performs high-privilege administrative actions including modifying the local Administrator account, configuring system-wide password policies, and enabling LSA Protection through registry modifications in HKLM.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted system data which could lead to instruction injection if values like local account names, group members, or network metadata are maliciously crafted.\n
- Ingestion points: SKILL.md (Get-LocalUser), references/details.md (Get-LocalGroupMember, Get-NetTCPConnection).\n
- Boundary markers: None identified; the agent processes raw command output directly.\n
- Capability inventory: Full administrative control over registry (Set-ItemProperty), accounts (Rename-LocalUser), services (Set-Service), and network policy (Set-NetFirewallProfile).\n
- Sanitization: No sanitization or validation of the ingested system data before processing.
Audit Metadata