The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/agent.py script communicates with established cybersecurity platforms for threat intelligence and endpoint management tasks. These connections are transparent and aligned with the skill's purpose.
Evidence: The script queries virustotal.com, mb-api.abuse.ch (MalwareBazaar), threatfox-api.abuse.ch, and api.crowdstrike.com.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface where it processes indicators of compromise (IOCs) from external threat intelligence sources to automate reporting and enterprise-wide searches.
Ingestion points: Malware metadata and associated IOCs are retrieved from the ThreatFox, VirusTotal, and MalwareBazaar APIs in scripts/agent.py.
Boundary markers: The script encapsulates IOC values in double quotes when dynamically building Splunk search queries.
Capability inventory: The script can read local files to compute hashes, query external APIs, and execute network isolation commands via the CrowdStrike Falcon API.
Sanitization: Data received from external APIs is parsed using standard JSON libraries, and the script is intended for use within a controlled security operations context.

conducting-malware-incident-response