The Agent Skills Directory

[COMMAND_EXECUTION]: The Python agent in scripts/agent.py executes the ausearch utility using subprocess.run. The implementation uses a list of arguments, which correctly avoids shell-based command injection.
[DATA_EXFILTRATION]: The skill requires access to sensitive host files such as /var/log/audit/audit.log and monitors paths like /etc/shadow. This data access is essential for the stated goal of intrusion detection but involves processing high-privilege system information.
[PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection because it parses Linux audit logs, which can contain arbitrary strings from untrusted process executions. There are no explicit boundary markers or sanitization steps used when processing the log content in scripts/agent.py, which could allow malicious log entries to influence downstream agent logic.

analyzing-linux-audit-logs-for-intrusion