The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to clone several well-known security detection repositories from GitHub, such as SigmaHQ, Splunk Security Content, and Elastic Detection Rules, to serve as local data sources.
[COMMAND_EXECUTION]: The installation process involves executing npx to run the MCP server and using curl to download the MITRE ATT&CK dataset. These are standard operations for setting up the tool's environment.
[DATA_EXFILTRATION]: The hosted version of the skill makes requests to detect.michaelhaag.org to perform queries, which involves sending an authorization token and user-provided search terms to the vendor's API.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing external security rules.
Ingestion points: Data is ingested from local rule directories and a hosted remote API.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its system guidelines and instructions potentially found within the fetched detection rules.
Capability inventory: The agent can search, analyze, and generate detections based on the ingested content.
Sanitization: The skill does not describe any specific validation or sanitization of the rule content before it is processed by the AI agent.

security-detections-mcp