The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external telemetry data such as Windows Event Logs (EVTX), Sysmon logs (JSON), and CSV exports. An attacker who can influence these logs could potentially inject data aimed at confusing the detection logic or the analyst reviewing the generated reports. However, this ingestion is necessary for the skill's primary function as a threat-hunting tool.\n
Ingestion points: The parse_evtx_file and scan_sysmon_json functions in scripts/agent.py, and parse_logs in scripts/process.py read external files.\n
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded instructions within the processed log data.\n
Capability inventory: The scripts include capabilities to read files and write findings to local JSON and Markdown report files.\n
Sanitization: The skill performs regex matching on the input data but does not include sanitization of the log content before including it in the output reports.

hunting-for-shadow-copy-deletion