The Agent Skills Directory

[SAFE]: The skill is designed for threat intelligence management and performs its stated functions without malicious intent. It implements best practices such as defanging malicious links and managing API keys via environment variables.
[DATA_EXFILTRATION]: The skill performs network operations to external security services (VirusTotal, AbuseIPDB) and threat sharing platforms (MISP, TAXII). These are documented, legitimate services for the skill's domain. Sensitive data is not accessed or transmitted to unauthorized third parties.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data (raw IOCs). The risk of this data influencing agent behavior is minimized by the use of strict regex patterns and structured output formatting.
Ingestion points: Extracting indicators from user-provided text or input files through the IOCExtractor class and extract_iocs function.
Boundary markers: No explicit instruction isolation markers are used, but data is treated as literal strings for processing.
Capability inventory: Network communication via requests, local file system write access for report generation.
Sanitization: Indicators are defanged (e.g., replacing http with hxxp and . with [.]) before being included in human-readable reports.

building-ioc-defanging-and-sharing-pipeline