The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends cloning the official SigmaHQ rules repository and installing several pySigma-related Python packages. These are well-recognized resources within the cybersecurity industry for threat detection.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Sigma rules, creating a data ingestion surface. Ingestion points: YAML rule files are loaded by scripts/agent.py. Boundary markers: Not present. Capability inventory: The script generates Splunk queries and writes MITRE ATT&CK Navigator layers to disk. Sanitization: The skill uses structured YAML parsing via the pySigma library and standard JSON serialization for output reports.
[COMMAND_EXECUTION]: The skill documentation includes examples of standard administrative tasks, such as installing dependencies via pip and performing rule operations with the sigma CLI. These are appropriate for the tool's intended use case.

building-detection-rules-with-sigma