skills/mukul975/anthropic-cybersecurity-skills/building-attack-pattern-library-from-cti-reports/Gen Agent Trust Hub
building-attack-pattern-library-from-cti-reports
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes external Cyber Threat Intelligence (CTI) reports containing untrusted data, which presents a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through CTI report text files read via the
--report-filesCLI argument inscripts/agent.pyand theparse_reportmethod inSKILL.md. - Boundary markers: No delimiters or 'ignore' instructions are used to distinguish report content from agent instructions during processing.
- Capability inventory: The skill's capabilities include reading local files and writing JSON-formatted library data and detection templates to the local filesystem.
- Sanitization: Extracted text snippets (such as the 'source_sentence' field) are included in the generated output without sanitization or escaping.
- [EXTERNAL_DOWNLOADS]: The skill fetches public MITRE ATT&CK enterprise data from the official MITRE GitHub repository to facilitate technique mapping. This is a reference to a well-known and trusted service.
Audit Metadata