The Agent Skills Directory

[SAFE]: The skill implements a standard security workflow for incident triage using established frameworks (NIST SP 800-61r3 and SANS PICERL).
[SAFE]: The Python agent script performs legitimate API requests to VirusTotal, a well-known and trusted security service, to enrich threat indicators.
[SAFE]: Authentication secrets (API keys) are handled securely via command-line arguments and are not hardcoded in the scripts or documentation.
[SAFE]: All external references point to reputable official documentation sites such as NIST, SANS, VirusTotal, and MITRE ATT&CK.
[SAFE]: Example malicious artifacts (e.g., encoded PowerShell) in the documentation are clearly identified as context for triage analysis and do not represent a threat within the skill's own operation.

triaging-security-incident