The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions utilize sudo for system-level administrative tasks, including the deployment of Zeek configurations (zeekctl deploy) and the application of iptables rules for host isolation as detailed in SKILL.md.- [COMMAND_EXECUTION]: The workflow involves multiple shell commands to configure log forwarding, install packages, and execute forensic collection tools such as Velociraptor as described in the SKILL.md workflow.- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python packages, specifically sigma-cli and python-evtx, to facilitate log analysis and rule conversion, as referenced in SKILL.md and scripts/agent.py.- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves parsing external data sources which could potentially contain malicious content designed to influence the agent's behavior.
Ingestion points: Zeek conn.log, smb_mapping.log, and Windows Security.evtx are processed by the scripts/agent.py script.
Boundary markers: None identified in the script's output or interpolation process in scripts/agent.py.
Capability inventory: The skill identifies capabilities for host isolation using iptables and service management via sudo as documented in SKILL.md.
Sanitization: The scripts/agent.py script uses structured parsing for data extraction but lacks explicit sanitization measures to prevent malicious log entries from affecting the downstream prompt context.

detecting-lateral-movement-in-network