ir-playbook
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: Section 9 of the skill includes a reference to a fictional security incident (the 2026 Stryker medtech wiper attack) and provides a URL using the domain 'krebsonsystems.com'. This domain mimics the established security news site 'krebsonsecurity.com'. Using lookalike domains for fictional events is deceptive and could lead users to untrusted or potentially malicious external sites if clicked in the agent's output.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted incident data, such as system logs, email headers, and malware artifacts, which constitutes a significant attack surface for indirect prompt injection.\n
- Ingestion points: Log entries, phishing payloads, and command-and-control communications as described in Sections 2 and 8.\n
- Boundary markers: Section 8 ('Prompt Injection Safety Notice') provides explicit guidelines instructing the agent to treat analyzed content as data rather than instructions and to ignore directives like 'ignore previous instructions' found within artifacts.\n
- Capability inventory: The skill is limited to 'Read', 'Grep', and 'Glob' tools. It lacks capabilities for network communication, external script installation, or shell command execution.\n
- Sanitization: The skill instructs the agent to reference sensitive values generically rather than outputting full credentials or keys.\n- [PROMPT_INJECTION]: Static detectors flagged strings related to overriding instructions; however, review confirms these are defensive safety controls (Section 8) intended to prevent the agent from following attacker-supplied directives found in evidence files, rather than attempts to bypass platform-level safety filters.
Audit Metadata