The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted log data (EVTX and CSV formats), which presents a surface for indirect prompt injection where malicious log entries could attempt to influence the agent's behavior.
Ingestion points: scripts/agent.py parses EVTX files, and scripts/process.py parses CSV files provided as command-line arguments.
Boundary markers: The skill does not implement specific delimiters or warnings for the agent to ignore instructions embedded within the logs it analyzes.
Capability inventory: The analysis scripts are restricted to local file I/O and regex processing; they do not possess network access or the ability to spawn subprocesses.
Sanitization: The scripts use regex to extract specific fields and output results in structured JSON format, providing basic structural isolation from the raw log content.
[EXTERNAL_DOWNLOADS]: The skill identifies the python-evtx library as a dependency for parsing Windows Event Logs. It also includes references to reputable security resources, including MITRE ATT&CK, the SigmaHQ GitHub repository, and the LOLBAS project, which are documented to support the skill's defensive purpose.
[SAFE]: The provided code and instructions are consistent with the stated goal of endpoint security monitoring. The scripts perform static analysis of log files and do not exhibit behaviors associated with credential harvesting, persistence, or privilege escalation.

detecting-evasion-techniques-in-endpoint-logs