The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is the ingestion and processing of data from external threat intelligence sources, which constitutes a potential attack surface.
Ingestion points: Data is ingested via modular inputs defined in SKILL.md and through fetching scripts in scripts/agent.py and scripts/process.py which contact external APIs and parse CSV files.
Boundary markers: The instructions do not define clear boundary markers or sanitization protocols to prevent the agent from misinterpreting instructions that might be embedded within malicious threat indicators.
Capability inventory: The skill allows for local file writing (CSV generation) and provides instructions for interacting with Splunk REST APIs to modify internal databases (KV stores).
Sanitization: While the skill uses structured formats like JSON and CSV, it lacks deep validation of indicator content before it is processed by the agent or entered into the SIEM environment.
[EXTERNAL_DOWNLOADS]: The skill scripts fetch threat indicator data from the AlienVault OTX API (otx.alienvault.com), which is a well-known security service.
[COMMAND_EXECUTION]: The documentation provides technical examples of using curl and the Splunk CLI for administrative configuration and data management.

building-threat-intelligence-enrichment-in-splunk