The Agent Skills Directory

[Command Execution]: The skill contains procedures to generate and execute PowerShell scripts on the host system.
Evidence: The file references/KUSTO_EXPLORER_LAUNCH.md provides instructions for the agent to use Set-Content and Start-Process to save .kql files and launch the Kusto Explorer application.
Context: This is designed as a convenience feature to automate the transition from a generated query to a local analysis tool. While automated command generation is a security consideration, the skill includes explicit developer guidance to avoid unsafe shell interpolation (such as PowerShell here-strings) to mitigate command injection risks.
[Data Exposure Consideration]: The skill facilitates access to schema-unified views of security events that may contain sensitive information.
Evidence: The Get_Event_Authentication_All function projects columns including PasswordHash, as noted in SKILL.md.
Context: Accessing authentication metadata is a standard requirement for cybersecurity threat hunting (e.g., detecting pass-the-hash attacks). Users should ensure that access to these functions is governed by appropriate role-based access controls within the target Kusto environment.
[Indirect Prompt Injection Surface]: The skill ingests user-provided indicators to generate hunting queries, which presents a potential injection surface.
Ingestion points: User-supplied indicators or search terms are interpolated into KQL query templates (e.g., Filename has "<INDICATOR>" in SKILL.md).
Boundary markers: The skill uses standard KQL let statements and quoted strings as delimiters, but does not explicitly instruct the agent to sanitize all possible KQL injection characters in user input.
Capability inventory: The skill utilizes tools such as kusto_query to execute the generated code and PowerShell for file system interaction.
Sanitization: The documentation in references/KUSTO_EXPLORER_LAUNCH.md proactively recommends using Set-Content rather than here-strings to prevent command injection during the file creation process.

azure-kusto-irql