skills/terminalskills/skills/logstash/Gen Agent Trust Hub

logstash

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes curl commands in Task E for monitoring Logstash performance via its local monitoring API.
  • Evidence: curl -s "http://localhost:9600/_node/stats/pipelines" | jq ... and curl -s "http://localhost:9600/_node/hot_threads?human=true" in SKILL.md.
  • These are standard administrative actions for managing a Logstash instance and target the local loopback interface.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines pipelines that ingest and parse external log data (nginx, application logs, Kafka streams).
  • Ingestion points: beats, tcp, and kafka input plugins defined in SKILL.md.
  • Capability inventory: The skill performs file system mapping via Docker volumes and network communication with Elasticsearch and Kafka.
  • Boundary markers: The instructions use Grok patterns and conditional logic to structure the data, but do not explicitly implement LLM-specific boundary markers for the processed content.
  • Sanitization: Logstash filters like grok, mutate, and fingerprint provide structured parsing and transformation of untrusted log data before it reaches downstream sinks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 03:22 PM