The Agent Skills Directory

[SAFE]: The skill implements a defensive cybersecurity tool for ransomware detection. It uses the watchdog library to monitor filesystem events on decoy files specifically created for this purpose.
[COMMAND_EXECUTION]: The script scripts/agent.py performs filesystem operations (read/write/move/delete) and process inspection via psutil. These are consistent with the documented purpose of deploying and monitoring canary files.
[EXTERNAL_DOWNLOADS]: The skill references standard Python libraries (watchdog, requests, psutil). While these are external dependencies, they are well-known, legitimate packages used for their intended purposes.
[DATA_EXFILTRATION]: No sensitive data exfiltration was found. The network operations (requests.post for Slack and smtplib for Email) are used exclusively for sending alerts containing telemetry about detected filesystem events.
[CREDENTIALS_UNSAFE]: While the script contains simulated 'secrets' in the canary file templates (e.g., fake AWS keys and database passwords), these are intentionally fake data designed to lure attackers and do not represent a credential exposure risk for the user.

deploying-ransomware-canary-files