The Agent Skills Directory

[Data Exposure & Exfiltration] (HIGH): Hardcoded credentials found in multiple configuration files.
Evidence: examples/architectures/elk-stack-docker-compose.yml hardcodes ELASTIC_PASSWORD=SecureElasticPassword123! for Elasticsearch and Logstash services.
Evidence: examples/architectures/wazuh-docker-compose.yml hardcodes INDEXER_PASSWORD=SecurePassword123! and API_PASSWORD=SecurePassword123!.
[Indirect Prompt Injection] (LOW): The skill creates a vulnerability surface by processing untrusted log data through detection rules.
Ingestion points: examples/detection-rules/brute-force-detection.yaml (Splunk search targeting index=auth).
Boundary markers: Absent.
Capability inventory: Subprocess calls via Docker services; network operations via Splunk/Wazuh alerting.
Sanitization: Absent.
[Unverifiable Dependencies & Remote Code Execution] (LOW): The Docker Compose files reference external images from vendor registries.
Evidence: docker.elastic.co/elasticsearch/elasticsearch:8.11.0 and wazuh/wazuh-manager:4.7.0 are standard images from known sources, but represent remote code dependencies.

siem-logging