The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted forensic artifacts, which presents an indirect prompt injection surface. • Ingestion points: Forensic artifacts including memory dumps (processed by Volatility), packet captures (processed by Zeek), and system logs (processed by Plaso) are ingested for analysis. • Boundary markers: No explicit boundary markers or delimiters are defined in the examples to separate the untrusted data from the agent's command context. • Capability inventory: The skill performs subprocess execution of forensics tools and network operations using curl and the requests library. • Sanitization: The documentation recommends using scripts that handle input validation and output parsing as a mitigation strategy.
[COMMAND_EXECUTION]: The skill utilizes command-line forensics tools (Volatility, Zeek, Plaso) to identify threat patterns, which is the primary and expected purpose of the skill.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by using environment variables (e.g., $ELASTICSEARCH_API_KEY) for authentication instead of hardcoding secrets.

threat-hunting