The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external Windows Event Log data (.evtx) which could contain malicious content if logs were tampered with by an adversary.
Ingestion points: The scripts/agent.py file reads log data from a path provided via command-line arguments.
Boundary markers: No explicit boundary markers or "ignore" instructions are used during log parsing.
Capability inventory: The script is limited to local file writing (generating a JSON report) and does not possess network access or shell execution capabilities.
Sanitization: Attribute values extracted from logs are truncated to 200 characters to provide a basic limit on data size.
[EXTERNAL_DOWNLOADS]: The skill requires standard third-party libraries for forensic analysis.
Source: Dependencies on python-evtx and lxml are noted, which are well-known and established tools for processing Windows events and XML data.
Context: The skill instructions require the user to manually install these packages via a package manager, ensuring the user maintains control over the environment setup.

hunting-for-t1098-account-manipulation