The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.check_output to execute PowerShell commands (Get-WinEvent) for retrieving local Windows Sysmon logs. This is a functional requirement for the skill's purpose as a threat detection tool.
Evidence: subprocess.check_output(["powershell", "-NoProfile", "-Command", ps_cmd], ...) in scripts/agent.py.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an analysis surface by ingesting external data (Sysmon event logs). While an adversary who has already compromised the system could theoretically manipulate log content to influence the agent's findings, the risk is considered low as the tool is designed for diagnostic use by a human analyst.
Ingestion points: Sysmon event logs queried via PowerShell in scripts/agent.py and JSON/CSV files parsed in scripts/process.py.
Boundary markers: The script uses structured JSON parsing to process the log data.
Capability inventory: Shell command execution via subprocess.check_output in scripts/agent.py and file system writes for report generation in both scripts.
Sanitization: Data is parsed using standard libraries (json, csv) and mapped to specific data structures before analysis.

detecting-t1055-process-injection-with-sysmon