The Agent Skills Directory

[PROMPT_INJECTION]: Static analysis identified a trigger for instruction override; however, this is a false positive. The content in Section 8 ('Prompt Injection Safety Notice') is actually a set of defensive instructions that tell the AI agent to ignore instructions found within user-provided data (like log files), which is a security best practice for handling untrusted input.
[EXTERNAL_DOWNLOADS]: The skill references several external resources including GitHub repositories (SigmaHQ, Atomic Red Team) and official documentation sites (sigmahq.io, mitre-attack.org). These are well-known, industry-standard security resources and do not involve the execution of untrusted remote code.
[DATA_EXFILTRATION]: No exfiltration patterns were detected. The skill explicitly instructs the agent in Section 8 to redact or generalize sensitive values (IPs, hostnames, usernames) found in analyzed logs before producing output.
[COMMAND_EXECUTION]: The skill uses limited, safe tools (Read, Grep, Glob) for data analysis and does not contain any patterns for arbitrary shell command execution or privilege escalation.
[REMOTE_CODE_EXECUTION]: There are no patterns involving the download or execution of remote scripts. The skill is designed to produce text-based documentation and Sigma detection rules.

detection-engineering