The Agent Skills Directory

Local Script Generation and Execution: The skill contains procedures in references/KUSTO_EXPLORER_LAUNCH.md to generate PowerShell scripts that write .kql files to the disk and launch the Kusto Explorer executable. While this involves dynamic command generation, the skill includes explicit security guidance to use Set-Content instead of here-strings to mitigate injection risks, and it requires the use of ask_user for explicit consent before any local action is taken.
Sensitive Data Access: The Get_Event_Authentication_All function is documented to retrieve PasswordHash fields from security logs. In the context of incident response and threat hunting, accessing such metadata is a standard requirement for identifying credential-based attacks, though it should be handled according to organizational security policies.
Indirect Prompt Injection Surface: As the skill processes results from security databases (via kusto_query), it may ingest untrusted data originating from logs. The skill uses this data to identify subsequent hunting targets (e.g., 'victim hosts'). While this represents an ingestion surface, the skill focuses on query composition rather than automated execution, and the documentation highlights the importance of user review.

azure-kusto-irql