The Agent Skills Directory

[SAFE]: The skill performs intended network analysis tasks using established libraries and methodologies. All script behaviors in scripts/agent.py align with the stated purpose of threat hunting for beaconing patterns in Zeek logs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Zeek log data, which represents a standard data processing attack surface for tools of this nature.
Ingestion points: The load_conn_log and analyze_dns_beaconing functions in scripts/agent.py read external conn.log and dns.log files.
Boundary markers: No specific delimiters or instructions to ignore embedded instructions are implemented in the log parsing logic.
Capability inventory: The agent performs file system read operations on logs and writes analysis results to a JSON report.
Sanitization: Data is aggregated into statistical scores (mean, standard deviation, coefficient of variation); no string-based sanitization is applied to the raw log fields included in the final findings.

detecting-beaconing-patterns-with-zeek