The Agent Skills Directory

[Untrusted Data Ingestion]: The skill is designed to process and analyze Unified Data Model (UDM) events, process command-lines, and entity telemetry. As these sources are external and potentially controlled by an adversary being investigated, they represent a surface for indirect prompt injection.
Ingestion points: The skill retrieves data via tools like udm_search, summarize_entity, and get_case as described in SKILL.md.
Boundary markers: The skill explicitly includes a 'Prompt Injection Defense Directive' instructing the agent to treat all retrieved telemetry strictly as data and not to execute commands embedded within logs.
Capability inventory: The skill possesses the capability to search events (udm_search), update case documentation (create_case_comment, update_case), and perform entity lookups.
Sanitization: The instructions provide a clear conceptual boundary for the AI to ignore instructions within data, which is an appropriate mitigation for a security investigation tool.
[Platform-Specific Tool Integration]: The skill utilizes specialized tools (e.g., udm_search, summarize_entity, list_cases) intended for use within the Google SecOps and SOAR ecosystem. These tools are appropriate for the skill's stated purpose of security analysis and incident response.

secops-investigate