The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/agent.py executes the chainsaw binary using subprocess.run(). It passes all arguments as a list, which is a secure implementation that prevents command injection by avoiding the use of a shell to interpret the execution string.
[EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to download the Chainsaw tool and Sigma rule sets from the official GitHub repositories of WithSecureLabs and SigmaHQ. These are established, well-known, and trusted organizations within the cybersecurity community.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted forensic data (Windows Event Logs), which creates a potential surface for indirect prompt injection if a malicious actor embeds instructions within the logs. However, this risk is inherent to the primary purpose of log analysis and threat hunting. Ingestion points: The evtx file path provided to scripts/agent.py; Boundary markers: None; Capability inventory: Execution of the chainsaw binary via subprocess; Sanitization: Input parameters are handled through argparse and passed as a list to the binary execution function.

hunting-evtx-with-chainsaw