The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and interpret data from security alerts generated by SIEM, EDR, and NDR systems. An external attacker who can manipulate the contents of these alerts could embed instructions aimed at influencing the agent's decision-making. The absence of specific boundary markers or instructions for the agent to ignore embedded commands in these data sources increases this risk. Ingestion points: SKILL.md (Alert Triage Workflow), references/triage-procedures.md, references/soc-incident-response.md. Boundary markers: Absent. Capability inventory: Tool usage for SIEM queries, API enrichment lookups, and triggering EDR endpoint isolation. Sanitization: Absent.
[PROMPT_INJECTION]: Eight reference files (including architecture-patterns.md, code-organization.md, and security-best-practices.md) contain extreme amounts of repetitive content, with exactly 150 redundant sections per file repeating generic technical boilerplate and code snippets. This deliberate bloating serves as a form of obfuscation by noise, making the skill difficult to audit and potentially masking malicious instructions from detection.
[COMMAND_EXECUTION]: The skill defines workflows and provides templates for executing high-privilege security commands. These include complex log analysis queries (SPL/KQL in references/threat-hunting.md), system-level event filtering, and EDR isolation commands. While functional, these instructions provide the agent with a blueprint for manipulating critical security infrastructure.
[DATA_EXFILTRATION]: The skill aggregation of highly sensitive organizational information, such as authentication logs, user HR statuses, and asset criticalities, creates a potential exfiltration vector. When combined with the described capability to perform external API enrichment lookups to third-party services, this data could be exfiltrated if the agent is manipulated via prompt injection.

soc-operations