Skill

performing-threat-hunting-with-elastic-siem

skill:mukul975/anthropic-cybersecurity-skills#performing-threat-hunting-with-elastic-siem

Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:45 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

93/93

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-threat-hunting-with-elastic-siem:skills/performing-threat-hunting-with-elastic-siem/scripts/agent.py:222:CRED

Security findings 1

Credential access

highContextual riskmedium confidence

Undeclared beyond the skill's stated hunting purpose, the agent.py main entry point hardcodes verify_certs=False so all queries run with TLS certificate verification disabled even though the documented get_es_client default is true, allowing an on-path attacker to intercept the ES_API_KEY bearer credential sent to the unverified host; plausibly done for self-signed internal clusters, hence contextual risk.

skills/performing-threat-hunting-with-elastic-siem/scripts/agent.py:222

es = get_es_client(host=host, verify_certs=False)

vector:code

Counter-argument considered

The quoted line is verbatim in the skill's executable entry point, which silently hardcodes verify_certs=False against the helper's own verify_certs=True default and the skill's hunting-only declaration, and the resulting client is passed to run_all_hunts' es.search calls, so nothing in the carve-outs or any mitigation neutralizes the TLS-weakening; a nuance (the shown __main__ path passes no api_key, so interception depends on credentials in the host URL or unshown callers) tempers severity but does not overturn the core contextual-risk claim.