The Agent Skills Directory

[SAFE]: The skill provides a legitimate incident response framework and triage utility. No obfuscation, unauthorized network operations, or hardcoded credentials were identified across the skill files or scripts.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted security event data (JSON payloads) which serves as an ingestion point for potential malicious instructions.
Ingestion points: scripts/incident_triage.py parses event.json files and stdin input.
Boundary markers: The tool generates structured output (JSON or text reports) to guide agent classification and escalation decisions.
Capability inventory: Workflows in SKILL.md instruct the agent to perform classification and escalation routing (e.g., paging CISO, declaring SEV1) based on the tool's findings.
Sanitization: Analysis is performed via recursive string flattening and static keyword matching in scripts/incident_triage.py, which helps ensure input strings are treated as data rather than executable instructions.
[SAFE]: The Python script uses only standard libraries (argparse, json, sys, datetime, typing, re) and does not perform any dynamic code execution or privileged system modifications.

incident-response