The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external threat intelligence feeds, which are untrusted data sources and represent a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through scripts/agent.py via TAXII server responses and local files read from the --ioc-file argument.
Boundary markers: There are no explicit boundary markers or instructions to isolate the untrusted feed content from the agent's processing logic.
Capability inventory: The scripts/agent.py script has capabilities to perform network requests using the taxii2-client library and write files to the local disk via the export_stix_bundle function.
Sanitization: The script performs basic validation by using regular expressions to classify indicator values into specific types such as IP addresses, domains, and hashes.
[EXTERNAL_DOWNLOADS]: The skill documentation and prerequisites reference the taxii2-client and stix2 Python packages. These are industry-standard, well-known libraries for managing threat intelligence data.
[COMMAND_EXECUTION]: The scripts/agent.py script executes file writes and network operations based on command-line arguments such as --taxii-url, --collection-url, and --output.

analyzing-threat-intelligence-feeds