The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/agent.py uses the attackcti library to retrieve APT group profiles and technique mappings from the official MITRE ATT&CK STIX/TAXII servers. This is an expected and legitimate use of external threat intelligence.
[COMMAND_EXECUTION]: The skill generates security-focused queries in SQL, VQL, and SPL. These are provided as static text for the analyst to review and manually execute in their respective monitoring environments; the skill does not execute these commands itself.

hunting-advanced-persistent-threats