The Agent Skills Directory

[SAFE]: The skill provides structured templates and automation scripts for generating SOC dashboards in Splunk, Elastic, and Grafana, following standard cybersecurity workflows.
[EXTERNAL_DOWNLOADS]: The skill references official resources from Splunk, a well-known service provider, including the Splunk Python SDK. These references are appropriate for the skill's stated purpose.
[CREDENTIALS_UNSAFE]: The Python agent in scripts/agent.py uses environment variables for Splunk authentication, which is a recommended security practice. The documentation in SKILL.md and references/api-reference.md uses obvious placeholders like changeme and <api_key> rather than exposing real secrets.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface for indirect prompt injection as it is designed to process untrusted security log data.
Ingestion points: Data is ingested from Splunk indices (e.g., index=notable) and local CSV lookup tables via SPL queries and the scripts/agent.py script.
Boundary markers: The skill does not implement explicit delimiters or boundary instructions for the ingested data, which is typical for SIEM-based analytical tools.
Capability inventory: The agent can perform read operations on Splunk data and write structured JSON output to the local file system.
Sanitization: No specialized sanitization is applied to the log entries before they are aggregated into the dashboard output, relying instead on the platform's default handling.

building-incident-response-dashboard