The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the official elastic CLI to perform cluster operations, which is the intended method for data access for this vendor-provided skill.
Evidence: The 'Operations' table in SKILL.md maps HTTP-style requests to elastic es and elastic kb commands for querying and metadata retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted telemetry data from cloud provider logs and metrics which represents a theoretical injection surface.
Ingestion points: Data enters the context via metrics-aws.*.otel-* and logs-* data streams accessed through ES|QL queries.
Boundary markers: Absent; there are no specific instructions for the agent to ignore potential instructions embedded within the retrieved log lines.
Capability inventory: The agent has the ability to query the cluster, resolve index patterns, and check field mappings using the elastic CLI.
Sanitization: Absent; the skill does not specify sanitization or escaping of log body text before analysis.
[EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for the Elastic CLI.
Evidence: SKILL.md links to https://github.com/elastic/cli#configuration for environment setup. As this is a resource from the skill author, it is documented neutrally.

observability-csp-investigation