The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses the splunk-sdk library to interact with Splunk Enterprise services. This is a standard, well-known dependency required for the skill's primary function.
Evidence: references/api-reference.md and scripts/agent.py specify the requirement and import of the splunklib client.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Windows event log data (Security, System, and Sysmon logs) which could theoretically be manipulated by an attacker to influence the agent. However, the risk is minimized as the skill is designed for forensic reporting and does not autonomously execute actions based on the log content.
Ingestion points: The skill fetches search results from Splunk in scripts/agent.py and stores them in the findings dictionary.
Boundary markers: No explicit prompt boundary markers or ignore-embedded-instruction warnings are used for the ingested data.
Capability inventory: The agent has network access to a Splunk host via the splunk-sdk.
Sanitization: No explicit sanitization or filtering is applied to the raw log data prior to reporting.

analyzing-windows-event-logs-in-splunk