The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches enrichment data and reputation scores from well-known threat intelligence platforms.
Evidence: scripts/agent.py makes network requests to virustotal.com, api.abuseipdb.com, and mb-api.abuse.ch to retrieve artifact metadata.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process potentially malicious strings (Indicators of Compromise) originating from untrusted external sources such as phishing emails or security alerts.
Ingestion points: The enrich_ioc function in scripts/agent.py accepts and processes arbitrary indicator strings provided as input.
Boundary markers: The skill includes logic to 'defang' indicators (e.g., changing http to hxxp) for safe handling in documentation and reports.
Capability inventory: The skill utilizes network communication capabilities via the requests library and the vt-py SDK.
Sanitization: Input indicators are validated and classified using specific regular expressions in the classify_ioc function to ensure they match expected formats (IPv4, SHA256, etc.) before processing.

analyzing-indicators-of-compromise