The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script executes the osqueryi command-line utility via subprocess.run to perform system audits. The queries are sourced from a hardcoded dictionary within the script, and CLI arguments are constrained to specific choices from that dictionary, which prevents arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The SKILL.md file provides instructions to download and install osquery from its official package repositories (e.g., pkg.osquery.io). These are well-known, trusted sources for the security software being deployed.
[INDIRECT_PROMPT_INJECTION]: The skill's scripts (scripts/agent.py and scripts/process.py) ingest and analyze system state data (process names, network sockets, logs). While this data is externally influenced, it is processed as structured JSON for reporting and manual analysis, following safe data handling practices for this domain.

deploying-osquery-for-endpoint-monitoring