The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The script scripts/agent.py processes alert data from external CSV files which may contain untrusted strings in fields like rule_name or source. These strings are interpolated into the final JSON report. While the script does not execute this data, there is a theoretical surface for schema confusion if downstream tools consume the report without validation.
Ingestion points: scripts/agent.py reads data via the load_alert_data function from the path specified by the --alert-csv argument.
Boundary markers: No explicit delimiters or instructions are used to separate untrusted data fields within the processing logic.
Capability inventory: The script is restricted to local file operations (read/write) using the csv and json modules. It does not utilize exec(), eval(), network libraries, or subprocess calls.
Sanitization: The script uses json.dump() for report generation, ensuring proper escaping for JSON format, but does not perform content validation on the input CSV fields.
[SAFE]: The skill's implementation aligns with its stated purpose of SIEM alert tuning. The Python agent utilizes standard library modules for data processing and does not perform any suspicious network operations, credential harvesting, or unauthorized command execution.

implementing-siem-use-case-tuning