The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.run to invoke the falco --validate command for checking the syntax of Falco rules. This is a local execution of a specific security tool and is implemented using an argument list rather than a shell string, which mitigates shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download Falco packages and configuration from official sources including falco.org, download.falco.org, and the falcosecurity.github.io Helm repository. These are well-known and official domains for the project described.
[DATA_EXFILTRATION]: No unauthorized data exfiltration or sensitive file access patterns were detected. The triage function in the accompanying script processes data locally and does not perform network operations.
[PROMPT_INJECTION]: The instructions are instructional and educational, lacking any patterns designed to bypass agent constraints or safety protocols.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or sensitive environment variable exposure were found in the provided files.

detecting-container-runtime-threats-with-falco