The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands, including the 'pup' CLI tool and 'jq', to query Datadog audit logs and perform remediation actions like API key revocation. This behavior is documented and aligned with the skill's stated purpose for security investigation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Datadog audit logs and possesses the capability to delete API keys, which creates a potential surface for indirect prompt injection where malicious log content could influence agent behavior.
Ingestion points: Audit log data retrieved via pup audit-logs search as defined in SKILL.md.
Boundary markers: No explicit delimiters or instructions for the agent to ignore content embedded in the logs are present.
Capability inventory: Execution of pup for data retrieval and pup api-keys delete for remediation in SKILL.md.
Sanitization: No explicit sanitization or filtering of log fields is implemented before processing.
[SAFE]: No hardcoded credentials, obfuscation, or unauthorized privilege escalation attempts were detected. Authentication recommendations follow standard best practices, such as using OAuth2 or environment variables.

dd-audit-key-compromise