skills/mukul975/anthropic-cybersecurity-skills/analyzing-malware-persistence-with-autoruns/Gen Agent Trust Hub
analyzing-malware-persistence-with-autoruns
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or behaviors were detected during the analysis of the skill's code and documentation.
- [COMMAND_EXECUTION]: The skill includes a Python script that utilizes
subprocess.runto call theautorunsc64.exebinary. This command execution is required for the skill's primary function of scanning Windows systems for persistence mechanisms. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted external data from CSV reports.
- Ingestion points: The scripts
scripts/agent.pyand the code block inSKILL.mdingest data from CSV files. - Boundary markers: Not present; the scripts read CSV columns directly as strings.
- Capability inventory: Local file reading and command execution via
subprocess.runinSKILL.md. - Sanitization: The data is parsed using standard libraries, but the content itself is not sanitized for potential injection strings targeting downstream LLM processing.
Audit Metadata