The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation references a setup script (curl -fsSL https://elastic.co/start-local | sh) from Elastic's official domain to assist users with local development environments. This is a legitimate vendor resource.
[DATA_EXFILTRATION]: Network communication is strictly limited to the Elasticsearch endpoints defined in the user's environment configuration. No unauthorized data exfiltration or credential harvesting patterns were detected.
[PROMPT_INJECTION]: The skill ingests data from Elasticsearch query results. Because this data (such as application logs) may originate from external sources, there is a potential surface for indirect prompt injection. However, the skill maintains clear boundaries by formatting results as structured tables and is intended specifically for data analysis.
[COMMAND_EXECUTION]: The skill uses a dedicated Node.js script to interact with the Elasticsearch API. No arbitrary shell execution or unsafe argument interpolation into system commands was found.

elasticsearch-esql