The Agent Skills Directory

[SAFE]: The skill provides functional Python scripts (scripts/agent.py and scripts/process.py) that perform local log analysis using regular expressions. These scripts search for well-known indicators of compromise (IOCs) such as UAC bypass techniques, token manipulation tools (e.g., JuicyPotato), and kernel exploits. The scripts do not perform network requests, exfiltrate data, or execute untrusted code.
[EXTERNAL_DOWNLOADS]: The skill references several external cybersecurity resources in references/standards.md, including the MITRE ATT&CK framework, Sigma rules, and the Atomic Red Team project. These are all well-known, trusted industry-standard sources for threat detection and are included solely for reference and documentation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process system logs (EVTX, JSON, CSV, and text). An evaluation of the evidence chain indicates: (1) Ingestion points are located in the log parsing functions of scripts/agent.py and scripts/process.py; (2) Boundary markers are absent as the tools are meant for CLI usage rather than direct LLM interpolation; (3) Capabilities are limited to reading logs and writing local reports; (4) The scripts implement basic sanitization by truncating long command lines to 200 or 500 characters before inclusion in reports.

detecting-privilege-escalation-attempts