The Agent Skills Directory

[SAFE]: The skill functions as a standard security auditing tool, and its behavior aligns with the stated purpose in the documentation. No hidden malicious functionality or obfuscation was found.
[COMMAND_EXECUTION]: The skill includes a Python script scripts/threat_signal_analyzer.py intended to be executed by the agent to perform log analysis. The script relies solely on Python standard library modules and performs read-only operations on specified log files.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted log data.
Ingestion points: scripts/threat_signal_analyzer.py reads external log files via the --file parameter (line 123).
Boundary markers: Absent; the script processes log entries as raw strings without delimiters or instructions to the agent to ignore embedded commands.
Capability inventory: The skill is limited to reading local files and reporting findings to standard output; it does not possess network access, subprocess execution capabilities, or dynamic evaluation functions.
Sanitization: Absent; the script outputs raw log snippets in the evidence field without escaping or validation.

threat-detection