The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The Logstash pipeline is designed to ingest and parse untrusted data from multiple external sources, including TCP inputs and container logs, which could be used to inject malicious content into the monitoring system.
Ingestion points: The skill configures beats inputs on port 5044, tcp inputs on port 5000, and Filebeat path-based inputs for container and Nginx logs in SKILL.md.
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings used to separate raw log data from control instructions in the Logstash pipeline.
Capability inventory: The skill utilizes Logstash DSL for parsing (grok, json, mutate) and outputting to Elasticsearch; it does not contain explicit subprocess calls or arbitrary code execution capabilities.
Sanitization: Log messages are parsed directly using the json filter and grok patterns without validation or sanitization of the content before it is indexed.
[COMMAND_EXECUTION]: The docker-compose.yml file mounts the Docker daemon socket (/var/run/docker.sock) into the Filebeat container. While this is used by the add_docker_metadata processor to enrich logs, the Docker socket is a sensitive interface that can be abused if the container is compromised.
[DATA_EXPOSURE]: The Filebeat configuration in SKILL.md requests read-only access to broad system paths, including all Docker container logs (/var/lib/docker/containers/*/*.log) and Nginx logs (/var/log/nginx/*.log). This provides the skill with access to potentially sensitive information stored within logs across the host environment.

elk-stack