The Agent Skills Directory

[SAFE]: The skill implements a signature-based detection mechanism for identifying Living Off the Land Binaries (LOLBins). The Python script scripts/agent.py performs static analysis on log data without executing dynamic code or invoking shell commands with user-controlled input.
[SAFE]: External references to the LOLBAS project and Sigma rules are directed to reputable community resources. The use of git clone for the LOLBAS repository is a documented and standard practice for obtaining the reference database.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted process telemetry logs, which serves as a potential surface for indirect prompt injection.
Ingestion points: scripts/agent.py processes JSON log files through the parse_process_events function.
Boundary markers: There are no specific delimiters or instructions defined in the skill to prevent the agent from following instructions embedded within the logs.
Capability inventory: The skill allows for local file read and write operations (scripts/agent.py) and utilizes standard Python libraries for analysis.
Sanitization: Log content (such as command-line arguments) is analyzed and reported without sanitization. While necessary for high-fidelity detection, this allows external data to enter the agent's context verbatim.

detecting-living-off-the-land-with-lolbas