The Agent Skills Directory

[SAFE]: The skill serves as a documentation and analysis framework for post-incident reviews. It follows professional security documentation standards (NIST SP 800-61 Rev. 3, SANS, CSF 2.0) and uses trusted reference materials from recognized cybersecurity organizations like CISA and MITRE.
[COMMAND_EXECUTION]: The skill provides numerous CLI and SQL command templates for forensic purposes in SKILL-TYPO3.md (e.g., find, grep, composer audit, and SQL SELECT statements). These are read-only diagnostic tools intended to assist a human responder or provide structure for an agent's analysis, and they do not involve unauthorized privilege escalation or autonomous execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because its primary function is to ingest and summarize external security data. This is documented as a risk factor inherent to the skill's purpose:
Ingestion points: User-provided incident logs, forensic command outputs, and system inventory details processed in SKILL.md and SKILL-TYPO3.md.
Boundary markers: The skill uses structured markdown templates for reports but lacks explicit instruction-ignore delimiters for interpolated data.
Capability inventory: The skill provides instructions for read-only forensic commands but lacks automated file-write or network-send capabilities.
Sanitization: No explicit sanitization or filtering of external content is defined in the instructions.

security-incident-reporting