The Agent Skills Directory

[SAFE]: The skill implements standard cybersecurity procedures for detection coverage mapping and gap analysis.
[EXTERNAL_DOWNLOADS]: The skill references a download of the MITRE ATT&CK STIX bundle from the official MITRE GitHub repository (mitre/cti). This is an authoritative and well-known service providing foundational security data.
[COMMAND_EXECUTION]: The skill provides Splunk and KQL query templates in SKILL.md to help users export data from their SIEM environments. These are informational and intended for manual use by security professionals.
[DYNAMIC_EXECUTION]: The provided Python scripts (scripts/agent.py and scripts/process.py) perform legitimate data aggregation and report generation. No dynamic code evaluation or unsafe deserialization of data was found.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: scripts/agent.py (processes user-provided detection rule and matrix JSON files).
Boundary markers: Absent.
Capability inventory: File read/write operations via the json module.
Sanitization: Absent. The script logic is strictly limited to dictionary lookups and mathematical calculations for reporting purposes, which presents a negligible risk surface.

implementing-mitre-attack-coverage-mapping