The Agent Skills Directory

[SAFE]: The skill is a comprehensive toolkit for detecting Active Directory DCSync attacks. It correctly identifies relevant event IDs (4662) and replication GUIDs associated with credential dumping techniques.
[COMMAND_EXECUTION]: The Python scripts (scripts/agent.py and scripts/process.py) process local log files provided as command-line arguments. They do not execute arbitrary shell commands or spawn subprocesses based on user input. The PowerShell queries included in the documentation and scripts are provided as strings for the user to run manually on domain controllers, rather than being executed by the skill itself.
[DATA_EXFILTRATION]: The scripts perform local file analysis and output findings to the console or local files. There are no network operations, HTTP requests, or other mechanisms for external data exfiltration.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external data (Windows Event Logs), it uses standard parsing libraries (JSON, CSV, and python-evtx) to extract specific fields. The logic is deterministic and does not pass unsanitized log content directly to an LLM context in a way that would trigger unintended actions.
[EXTERNAL_DOWNLOADS]: The scripts/agent.py script attempts to import the python-evtx library. This is a standard dependency for parsing EVTX files and is handled gracefully with an error message if missing, rather than performing an unauthorized download.

detecting-dcsync-attack-in-active-directory