cobalt-strike-aggressor-development
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a massive documentation repository for the Sleep programming language and Cobalt Strike Aggressor Scripting.
- [EXTERNAL_DOWNLOADS]: The file
references/sleep-functions/fetch_docs.pycontains logic to fetch documentation fromhttps://sleep.dashnine.org/manual/. This is the official source for Sleep documentation and is used here for documentation maintenance. - [PROMPT_INJECTION]: A static analysis flag was raised regarding
references/aggressor-functions/beacon_job_hide_output.mdfor 'attempts to conceal actions'. This is a false positive; the file documents thebeacon_job_hide_outputfunction within Cobalt Strike, which allows operators to suppress job output in the tool's console. It is not an attempt to hide the AI agent's actions from the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes a large volume of documentation (627 files). While this represents a data ingestion surface, the content is purely technical documentation for programming and security tools, with no evidence of embedded malicious instructions.
Audit Metadata