skills/mukul975/anthropic-cybersecurity-skills/analyzing-security-logs-with-splunk/Gen Agent Trust Hub
analyzing-security-logs-with-splunk
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill leverages the official
splunk-sdkto interact with Splunk infrastructure, and its logic is consistent with standard security analyst workflows. No unauthorized data exfiltration or malicious commands were detected.\n- [PROMPT_INJECTION]: Theagent.pyscript contains a potential surface for indirect prompt injection, specifically SPL injection, in the query construction logic.\n - Ingestion points: User-supplied
hostsanduserslists via command-line arguments inscripts/agent.py.\n - Boundary markers: No delimiters or boundary markers are used to separate user data from the SPL query logic.\n
- Capability inventory: The script executes arbitrary SPL searches on a Splunk instance using the
service.jobs.createmethod.\n - Sanitization: Input parameters are directly interpolated into the query string using Python f-strings without any validation or escaping.
Audit Metadata