implementing-threat-intelligence-platform

Pass

Audited by Gen Agent Trust Hub on Mar 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious behavior detected. The skill's operations are transparent and align with its stated purpose.\n- [EXTERNAL_DOWNLOADS]: The skill downloads threat data from reputable security services (abuse.ch) for IOC ingestion.\n- [DATA_EXFILTRATION]: External network requests are restricted to well-known security APIs and the user-specified MISP instance.\n- [PROMPT_INJECTION]: Evaluation of potential indirect prompt injection surface through ingestion of external threat feeds.\n
  • Ingestion points: ingest_urlhaus_feed and ingest_feodotracker_feed in scripts/agent.py.\n
  • Boundary markers: Data is parsed as structured JSON for specific IOC fields.\n
  • Capability inventory: Network communication with MISP/APIs and local report writing.\n
  • Sanitization: Indicators are extracted from validated external schemas.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 15, 2026, 09:39 PM