The Agent Skills Directory

[SAFE]: The skill provides comprehensive templates for security operations. It encourages the use of version control, peer review, and automated testing for detection rules. Examples include secure practices such as referencing GitHub Secrets (${{ secrets.SPLUNK_USER }}) rather than hardcoding credentials.
[INDIRECT_PROMPT_INJECTION]: While the skill is designed to ingest and process external data (threat intelligence feeds and logs), it incorporates significant safety controls to mitigate risks from untrusted content.
Ingestion points: External threat intelligence, Sigma rules from Git repositories, and log samples used for validation testing.
Boundary markers: The instructions mandate that every detection rule must include a validation test case and pass syntax checks (sigma check) before deployment.
Capability inventory: The skill uses curl and az CLI commands to deploy compiled rules to SIEM platforms.
Sanitization: Automated CI/CD steps are defined to verify ATT&CK mapping and rule integrity, ensuring that external data is validated and tested before it influences system configuration.

Threat Detection Engineer