The Agent Skills Directory

[SAFE]: The skill provides legitimate security analysis utilities. The logic for entropy calculation (Shannon Entropy) and DNS tunneling detection is consistent with industry standards for threat hunting.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process untrusted DNS log data.
Ingestion points: The parse_zeek_dns_log function in scripts/agent.py reads external log files provided via file paths.
Boundary markers: None are implemented within the ingestion logic to separate data from instructions.
Capability inventory: The script performs file read operations and processes string data; no dangerous capabilities like subprocess execution or network writes are present in the script code.
Sanitization: The script uses basic tab-delimited parsing. While it does not sanitize against prompt injection, the risk is negligible as the data is used for mathematical analysis rather than being passed to an execution context.

analyzing-dns-logs-for-exfiltration