threat-hunting-evasion
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of command-line tools for security analysis and evasion, including Git for repository cloning, Sigma for rule conversion, YARA for scanning, and various Windows utilities like Sysmon and reg. These are used in the context of security methodology research.
- [EXTERNAL_DOWNLOADS]: References and instructions fetch configuration and rules from well-known and trusted sources, including the official SigmaHQ GitHub repository, the Elastic detection rules repository, and the YARA rules community project.
- [DYNAMIC_EXECUTION]: The skill includes technical templates for research purposes, such as a Python-based YARA scanner and a C# snippet demonstrating reflection-based loading of .NET assemblies to bypass detection engines.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external datasets like Sigma/YARA rules and system telemetry. While no active injection is present, this capability creates a potential surface where untrusted input could attempt to influence the agent's interpretation of security findings.
Audit Metadata