The Agent Skills Directory

[SAFE]: The skill performs legitimate threat hunting operations using static analysis and statistical methods on network logs. It does not perform network operations, execute remote code, or request elevated privileges. All external references are to reputable cybersecurity entities and repositories.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Zeek network logs (ssl.log, conn.log, http.log). However, the processing is performed via a standalone Python script that uses strict parsing and regex matching. It does not interpolate this data into LLM prompts in an unsafe manner, nor does it use the data for dynamic code execution.
Ingestion points: Reads local log files via file path arguments in scripts/agent.py.
Boundary markers: Not applicable as the script is a deterministic parser.
Capability inventory: File read/write access to user-specified directories.
Sanitization: Uses regex and field-specific splitting to avoid injection into the script logic.

hunting-for-cobalt-strike-beacons