The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py invokes local system administrative tools including wevtutil to query the Windows Security event log and powershell to enumerate Domain Controllers and check replication ACLs. These executions are necessary for the skill's primary function of auditing and threat hunting within a Windows domain environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from Windows Event Logs. While the data is parsed into a structured report, malicious content injected into log fields (such as spoofed account names) could be used to attempt to influence an AI agent's analysis during incident response.
Ingestion points: scripts/agent.py processes system event data from the local Security log or from a user-provided .evtx file.
Boundary markers: The generated report does not implement explicit delimiters or security warnings to prevent downstream AI agents from interpreting data content as instructions.
Capability inventory: The skill environment allows for local command execution and file writing.
Sanitization: The script uses standard XML parsing to extract data but does not perform additional validation or sanitization on the content of the event log fields before report generation.

hunting-for-dcsync-attacks