The Agent Skills Directory

[SAFE]: The skill provides legitimate threat-hunting workflows, Splunk queries, and Python scripts for analyzing Zeek dns.log files. All scripts use standard Python libraries for mathematical calculations and file parsing. No credentials, exfiltration, or unauthorized command execution were found.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Zeek dns.log files, which contain DNS query strings that are influenced by external network actors. This creates a potential surface for indirect prompt injection if an AI agent processes these logs without sufficient sanitization.
Ingestion points: The scripts scripts/agent.py (via load_dns_log) and scripts/process.py (via parse_zeek_dns) read logs from user-specified file paths.
Boundary markers: The scripts do not implement specific delimiters for the untrusted data, although they treat queries as strings for statistical analysis.
Capability inventory: The scripts are restricted to local file reading, console output, and local report generation; they lack network communication or dangerous subprocess execution capabilities.
Sanitization: The scripts use standard TSV, CSV, and JSON parsing logic to extract fields, which limits the risk of command injection within the script execution itself.

hunting-for-dns-tunneling-with-zeek