The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The WazuhClient class in scripts/agent.py disables SSL certificate verification (verify=False) for all API requests to the Wazuh manager. This practice bypasses transport layer security and makes communication vulnerable to interception, potentially exposing the authentication tokens used for management.
[DATA_EXFILTRATION]: The check_file_integrity function in scripts/agent.py accesses and computes SHA256 hashes for highly sensitive system files, including /etc/shadow, /etc/passwd, and /etc/sudoers. While this is a standard activity for host-based intrusion detection, it represents an exposure of sensitive system configuration and credential metadata.
[COMMAND_EXECUTION]: scripts/agent.py uses the subprocess module to execute osqueryi for system inspection. This allows the script to run arbitrary SQL queries against the host operating system to monitor processes and system state.
[EXTERNAL_DOWNLOADS]: The skill provides instructions in SKILL.md to download and install the Wazuh agent and its associated GPG repository keys directly from packages.wazuh.com. These downloads are performed using curl and Invoke-WebRequest and are immediately used for system-level installation.

configuring-host-based-intrusion-detection