detecting-exfiltration-over-dns-with-zeek

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The script scripts/agent.py implements a legitimate cybersecurity analysis tool that processes Zeek DNS logs to detect data tunneling. It uses standard statistical methods like Shannon entropy calculations.
  • [SAFE]: No network connectivity, external data transmission, or remote code execution patterns were identified. The script operates entirely on local files provided via command-line arguments.
  • [SAFE]: The skill does not contain any hardcoded credentials, sensitive file path access (e.g., SSH keys, cloud configs), or privilege escalation attempts.
  • [SAFE]: All dependencies are restricted to the Python standard library (argparse, json, math, sys, collections), and no obfuscation or deceptive metadata was found.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 08:01 AM