The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's documentation and scripts reference external industry-standard resources, such as the MITRE ATT&CK framework, Sigma detection rules, and the pyspf Python library for email security validation. These are documented for reference purposes and originate from well-known or trusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources (email logs and endpoint telemetry) to identify threat indicators, which creates a potential surface for indirect prompt injection via malicious log entries.
Ingestion points: scripts/agent.py (via the --email-log argument) and scripts/process.py (via the --input argument).
Boundary markers: No explicit delimiters or boundary markers are used to wrap ingested data during processing.
Capability inventory: The skill's scripts are restricted to local file system read and write operations for log analysis and report generation.
Sanitization: Ingested data is evaluated against regular expression patterns to detect indicators; the skill focuses on identification and does not execute the data content.
[METADATA_POISONING]: There is an inconsistency between the author name listed in SKILL.md (mahipal) and the copyright holder identified in the LICENSE file (mukul975). This appears to be a documentation oversight rather than a malicious attempt at deception.

hunting-for-spearphishing-indicators