The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py utilizes subprocess.run to execute the Windows reg query utility. This is used to programmatically audit local registry settings related to NTLM, SMB signing, and LLMNR configuration. Additionally, scripts/audit_smb_signing.ps1 uses Invoke-Command and New-CimSession for remote system auditing, which is consistent with the skill's purpose in a domain environment.
[EXTERNAL_DOWNLOADS]: The documentation and scripts identify python-evtx and lxml as external dependencies required for parsing binary event logs and XML content. These are well-known libraries for security analysis and forensic tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources including Windows Security Event logs and CSV host inventories. 1. Ingestion points: Files are ingested via the --evtx and --inventory arguments in scripts/agent.py and scripts/detect_ntlm_relay.py. 2. Boundary markers: The skill relies on deterministic parsing of structured binary and text formats by dedicated scripts rather than providing raw data directly to the AI agent's context. 3. Capability inventory: The skill includes scripts that execute system commands (reg query) and remote management commands (Invoke-Command) for auditing purposes. 4. Sanitization: The scripts parse and filter specific event IDs and data fields, converting them into structured JSON reports, which reduces the risk of malicious payload injection from the logs.

detecting-ntlm-relay-with-event-correlation