mid-engagement-ir-detection
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell script snippets for automating engagement monitoring tasks.
- Evidence: Use of
curl,bc, andpython3heredocs in the 'Tooling — automated state-change detection' section to measure response times and process JSON logs. - [EXTERNAL_DOWNLOADS]: The provided automation logic performs network requests to target infrastructure.
- Evidence: The bash watcher script utilizes
curl -skto fetch timing data from user-supplied target URLs. - [DATA_EXFILTRATION]: The skill instructs the operator to capture and persist engagement-sensitive data to local files.
- Evidence: Instructions describe saving response headers, WAF cookies, and authentication state (from
o365_attempts.json) into local files such asengagement_log/baseline.jsonandengagement_log/journal.jsonl.
Audit Metadata