The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a script (scripts/agent.py) for administrative interaction with a Wazuh manager instance. It uses the Python requests library to perform legitimate management operations as described in the documentation.
[CREDENTIALS_UNSAFE]: The script handles sensitive API credentials by accepting them as command-line arguments (--password). While functional, this makes the credentials visible in system process lists, which is a common security consideration for command-line tools.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The WazuhDetectionAgent in scripts/agent.py fetches agent statuses, configuration, and alert descriptions from the Wazuh REST API.
Boundary markers: The data retrieved from the API is not wrapped in specific delimiters before being written to the output report.
Capability inventory: The skill performs network operations to a user-defined URL and writes data to the local file system (wazuh_detection_report.json).
Sanitization: The script uses standard JSON serialization for report generation and does not execute or evaluate the content of the ingested data.
[SAFE]: The implementation includes an option to bypass TLS certificate verification (SKIP_TLS_VERIFY). This is a documented administrative feature intended for lab or internal environments where SIEM managers may use self-signed certificates.

implementing-endpoint-detection-with-wazuh