The Agent Skills Directory

[SAFE]: All components of the skill align with standard cybersecurity analysis practices, utilizing legitimate frameworks and methodologies for attribution assessment. The skill facilitates structured analysis without introducing malicious behaviors or hidden logic.
[EXTERNAL_DOWNLOADS]: The documentation provides neutral examples of interaction with official APIs for well-known security platforms, such as VirusTotal and PassiveTotal, for the purpose of data enrichment and investigation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external threat campaign data and malware artifacts, establishing a surface for indirect instructions if the analyzed content is attacker-controlled.
Ingestion points: Campaign evidence and actor profiles are loaded from local JSON files in scripts/process.py, and suspicious strings from malware are processed in scripts/agent.py.
Boundary markers: The processing logic does not include specific delimiters or instructions for the agent to ignore potentially malicious embedded content within the analyzed data.
Capability inventory: The skill utilizes the attackcti library for network-based threat intelligence lookups and performs local file system operations to read evidence and write reports.
Sanitization: Analysis is performed through regular expressions and set-based similarity comparisons; the skill does not explicitly sanitize the raw string content for downstream agent processing.

analyzing-campaign-attribution-evidence