The Agent Skills Directory

[SAFE]: The skill is intended for defensive security monitoring and provides configuration guidance for PAM solutions.
[COMMAND_EXECUTION]: The Python agent script scripts/agent.py executes a hardcoded PowerShell command to gather RDP session data, which is a legitimate and safe monitoring function.
[INDIRECT_PROMPT_INJECTION]: The script processes external log data, which represents a potential attack surface, but it uses safe parsing methods (regex) and does not execute or interpolate the data into prompts.
[REMOTE_CODE_EXECUTION]: High-risk commands and remote execution patterns found in SKILL.md are documented as trigger patterns for security alerts in a Privileged Threat Analytics system, not as commands for the agent to perform.

implementing-privileged-session-monitoring