The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py executes hardcoded PowerShell commands via subprocess.check_output to query local Windows Event logs (Get-WinEvent). These operations are restricted to diagnostic data retrieval and are consistent with the skill's documented purpose for security auditing.
[INDIRECT_PROMPT_INJECTION]: The scripts/process.py script ingests external data from JSON and CSV logs, creating a potential attack surface. Ingestion points: The parse_events function in scripts/process.py reads file content from the local file system. Boundary markers: None identified in the prompt or data handling logic. Capability inventory: The script performs read-only analysis and pattern matching; it lacks network access or the ability to modify system configurations. Sanitization: None implemented, though the risk is minimal as the data is primarily used for regex-based threat identification and not interpreted as executable commands.

detecting-t1003-credential-dumping-with-edr