The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents and provides code examples for executing security response actions, such as endpoint isolation via CrowdStrike and domain blocking via Proofpoint. These are core functionalities of a SOAR automation skill and are presented with robust safety controls, including manual approval gates and human-in-the-loop requirements for high-impact actions.
[EXTERNAL_DOWNLOADS]: The playbooks and scripts reference well-known security services such as VirusTotal, AlienVault OTX, AbuseIPDB, and MaxMind for data enrichment. These are standard, legitimate resources in security operations.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management by using placeholders (e.g., {{credential.FIREWALL_API_KEY}}) and environment variables rather than hardcoding credentials. It explicitly instructs users to use SOAR platform secret stores.
[SAFE]: The skill includes extensive documentation on error handling, safety "kill switches," and version control. No obfuscation, persistence mechanisms, or unauthorized remote code execution patterns were found. The use of standard Python libraries like requests and testing frameworks like pytest is routine and safe.

soar-automation