The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and scripts rely on several external Python libraries including medallion, stix2, taxii2-client, opentaxii, cabby, and requests. These are standard tools within the cybersecurity domain for handling STIX/TAXII data.
[COMMAND_EXECUTION]: The docker-compose.yml configuration provided in SKILL.md contains a command that executes pip install medallion at runtime within the container to ensure the server implementation is available.
[SAFE]: The Python script scripts/agent.py performs a configuration audit of an OpenTAXII server by querying status and compliance endpoints. It uses standard authentication headers and handles responses without performing any unauthorized data exfiltration or system modification.
[SAFE]: The skill includes code snippets for integrating with SIEM/SOAR platforms (Splunk and Elasticsearch). While the Splunk integration uses verify=False in its requests.post call (disabling SSL verification), this is presented in a tutorial context for internal lab environments and does not indicate malicious intent.
[SAFE]: The skill processes external threat intelligence data via the TAXIIConsumer class.
Ingestion points: Untrusted data enters the agent context through the poll_collection method in SKILL.md, which retrieves STIX bundles from a TAXII server.
Boundary markers: None are present in the provided code snippets to distinguish between instructions and data.
Capability inventory: The skill has the capability to write data to external SIEM/SOAR endpoints using requests.post as seen in the push_to_splunk and push_to_elasticsearch functions in SKILL.md.
Sanitization: The extraction logic in extract_iocs_for_siem performs field extraction but does not include explicit sanitization or validation of the pattern content.

implementing-taxii-server-with-opentaxii