The Agent Skills Directory

[COMMAND_EXECUTION]: The skill and the script scripts/agent.py use standard Python file system APIs to create, read, and monitor files. These operations are necessary for the described purpose of detecting ransomware activity via decoy files and do not involve arbitrary or dangerous command execution.
[EXTERNAL_DOWNLOADS]: The documentation and code snippets reference established and reputable libraries, specifically watchdog and python-docx. It also points to Canarytokens.org, which is a well-known and trusted service in the cybersecurity community for generating honeytokens.
[DATA_EXFILTRATION]: No network activity or data exfiltration logic is present in the provided Python scripts. Monitoring alerts are output locally to the system log or console.
[INDIRECT_PROMPT_INJECTION]: The skill monitors file names and metadata for changes. While it processes data from the file system, it does not interpolate this data into executable commands or LLM prompts in a way that could lead to instruction override.

deploying-decoy-files-for-ransomware-detection