The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from third-party security APIs and stores it in the OpenCTI platform, creating a surface for potential indirect prompt injection if the source data contains malicious instructions.
Ingestion points: Data is fetched from VirusTotal, Shodan, AbuseIPDB, and GreyNoise APIs in scripts/process.py and the connector code in SKILL.md.
Boundary markers: The notes created in OpenCTI do not include specific delimiters to mark external content as untrusted for downstream processing.
Capability inventory: The skill uses the pycti library to write notes and update indicator scores within an OpenCTI instance.
Sanitization: External data is stored as JSON or Markdown without specialized sanitization for potential natural language instructions.
[DATA_EXFILTRATION]: The skill makes legitimate network requests to well-known cybersecurity services to fetch enrichment data.
Fetches indicator reputation and behavioral analysis from VirusTotal.
Retrieves network exposure and vulnerability information from Shodan.
Accesses IP reputation and reporting data from AbuseIPDB.
Queries GreyNoise for IP classification and internet noise context.
Gathers domain registration and DNS details from SecurityTrails.
[EXTERNAL_DOWNLOADS]: The skill requires standard Python libraries for interacting with threat intelligence platforms and making network requests.
Instructions include installation of the pycti OpenCTI client.
Requires the stix2 library for STIX data model support.
Uses the standard requests library for API communication.

building-ioc-enrichment-pipeline-with-opencti