The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script agent.py references the python-evtx library for parsing Windows Event Log files. This is a standard and well-recognized library used in the forensic analysis and security community for its intended purpose of log processing.
[PRIVILEGE_ESCALATION]: The skill provides PowerShell instructions to modify registry keys within HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ to enable Script Block and Module Logging. While these modifications require administrative privileges, they are standard defensive configuration steps necessary for generating the telemetry this skill is designed to analyze.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted log data (EVTX and CSV logs) which could contain attacker-controlled script content. The analysis confirms that the processing scripts (agent.py, process.py) use regex for pattern matching and do not execute or evaluate the content of the logs, effectively mitigating the risk of instructions in the logs affecting the agent.
Ingestion points: agent.py processes .evtx files and process.py processes .csv files.
Boundary markers: The scripts rely on the structured nature of the log formats (XML data in EVTX and delimited rows in CSV) to isolate data fields.
Capability inventory: The analysis identified file read operations and regex matching; there are no exec, eval, or subprocess calls that interact with the parsed log content.
Sanitization: The scripts truncate extracted script excerpts to 300 characters, preventing the propagation of large payloads into the detection reports.

detecting-fileless-attacks-on-endpoints