The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and scripts involve downloading the misp-docker repository from the MISP organization's official GitHub repository to facilitate platform deployment. This is documented neutrally as a standard administrative task using a well-known service.
[REMOTE_CODE_EXECUTION]: Deploying the threat intelligence platform involves executing Docker containers and configurations retrieved from the MISP project. This behavior is the primary and intended purpose of the skill to establish a local intelligence sharing environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process threat intelligence data from external OSINT feeds (such as URLhaus and CIRCL), which constitutes a potential surface for indirect prompt injection via malicious indicators.
Ingestion points: External feeds configured in SKILL.md and processed via scripts/process.py (e.g., collect_recent_iocs).
Boundary markers: The filter_warninglists function in scripts/process.py is present to filter indicators against known-good lists, reducing the risk of malicious or false-positive data ingestion.
Capability inventory: The skill includes capabilities to write data to the local file system (e.g., export_csv, export_stix2 in scripts/process.py).
Sanitization: The skill utilizes structured data formats (JSON, CSV, STIX 2.1) and the official PyMISP library to handle and validate external content.
[COMMAND_EXECUTION]: The documentation provides shell commands for cloning repositories and initializing the environment using Docker, which are standard for the described DevOps workflow.

collecting-threat-intelligence-with-misp