crowdstrike-security
Fail
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
references/workflows.mdcontains a reference tohttps://malicious-site.com/payload.exe, which has been identified as a phishing URL by automated scanners. This URL points to a remote executable file, posing a risk of malicious software acquisition.\n- [PROMPT_INJECTION]: The skill package includes a file namedEVALUATION_REPORT.mdwhich uses a self-referential injection pattern to claim a security score of 9.66/10 and a 'SAFE' verdict. This is an attempt to establish false authority and bias independent security assessments.\n - Ingestion points: Skill documentation and evaluation files (EVALUATION_REPORT.md).\n
- Boundary markers: Absent; the report is presented as an objective, authoritative fact within the skill context.\n
- Capability inventory: The skill references powerful host-level interaction capabilities including process termination (
kill), file deletion (rm), and memory collection (memdump) via CrowdStrike Falcon RTR commands.\n - Sanitization: None; the skill does not contain instructions to validate its own claims or ignore documentation-based evaluations.\n- [COMMAND_EXECUTION]: The skill provides templates and workflows for high-privilege shell and Real Time Response (RTR) commands, which involve direct manipulation of processes and the file system on the host endpoint.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata