The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected. The skill is purely instructional and provides high-quality templates for security operations workflows.
[EXTERNAL_DOWNLOADS]: The skill provides examples of using standard package managers to install well-known security tools (e.g., pip install sigma-cli) and common CLI utilities (Azure CLI) within a CI/CD context. These references target well-known repositories and registries, aligning with standard developer and security engineer practices.
[COMMAND_EXECUTION]: Examples of shell commands (e.g., curl, az, sigma) are provided within a GitHub Actions template. These are standard for automating the deployment of detection rules to SIEM platforms and include proper use of environment secrets for authentication, demonstrating security awareness.
[DATA_EXPOSURE_AND_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. Security-sensitive terms (like lsass.exe) appear only within the context of security monitoring queries designed to detect malicious activity, which is the primary purpose of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill has a standard vulnerability surface for an agent that processes external data:
Ingestion points: Processes log data, threat intelligence feeds, and community-sourced Sigma rules as described in SKILL.md.
Boundary markers: The instructions emphasize manual peer-review and automated testing of rules before deployment, though the rule templates themselves do not use explicit delimiters for the data they query.
Capability inventory: Includes command execution and network access to SIEM APIs via the documented GitHub Actions workflow in SKILL.md.
Sanitization: Recommends validating Sigma syntax and testing rules against sample logs to ensure efficacy and safety.

threat-detection-engineer