malware-scan-yara
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill invokes the
yaracommand-line utility for its intended purpose of file scanning. All provided examples are standard usage patterns for threat hunting. - [EXTERNAL_DOWNLOADS] (SAFE): The skill references the community YARA rules repository on GitHub. This is an industry-standard source and is used only for data (rules), not executable binaries.
- [PROMPT_INJECTION] (LOW): The skill possesses a surface for indirect prompt injection because it processes untrusted data from the local file system.
- Ingestion points: Files and directories processed at
<target-path>. - Boundary markers: None identified in the prompt instructions.
- Capability inventory: Execution of the
yarabinary and writing of results to disk usingtee. - Sanitization: No logic exists to sanitize or escape content from scanned files before reporting results to the user.
Audit Metadata