The Agent Skills Directory

[COMMAND_EXECUTION]: The hardening_checker.py script executes various system commands using subprocess.run() to audit the security posture of Linux systems.
Evidence: The script runs sysctl, systemctl, ufw, iptables, lsmod, and nft to gather configuration data.
The implementation uses list-based arguments which mitigates command injection risks.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download security utilities from well-known and trusted sources.
Evidence: Fetches the Sysmon utility from Microsoft's Sysinternals service (live.sysinternals.com).
Evidence: Downloads a recommended security configuration file from the SwiftOnSecurity GitHub repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted system data, logs, and configurations to provide security advice.
Ingestion Points: Processes /etc/ssh/sshd_config, auditd logs, and system telemetry in hardening_checker.py.
Boundary Markers: The skill includes an 'Evidence Contract' in SKILL.md that instructs the agent to separate observed, inferred, and unverified conclusions, reducing the risk of accidental obedience to instructions embedded in data.
Capability Inventory: The agent is authorized to generate hardening commands and scripts based on its analysis.
Sanitization: No explicit programmatic sanitization is present, but the instructions emphasize manual verification of all generated rules and commands before deployment.

15-blue-team-defense