The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (artifacts) such as URLs, IP addresses, and file hashes ingested from emails or SIEM alerts. (1) Ingestion points: SKILL.md (Step 2 & 3) demonstrates playbooks fetching artifacts from event containers via phantom.get_artifacts. (2) Boundary markers: There are no explicit sanitization or boundary markers implemented in the provided Python snippets to isolate or verify artifact metadata before processing. (3) Capability inventory: The playbooks are designed to perform high-impact actions including blocking URLs/IPs on firewalls, isolating endpoints via EDR, and disabling Active Directory accounts. (4) Sanitization: The logic lacks validation for artifact data before it is used in decision-making blocks (e.g., reputation thresholds), which could be exploited to trigger automated Denial of Service actions against legitimate resources.
[CREDENTIALS_UNSAFE]: The scripts/agent.py utility script disables SSL certificate verification, which undermines the security of the authentication token during transport. Evidence: The script uses requests.packages.urllib3.disable_warnings(InsecureRequestWarning) and sets self.session.verify = False by default in the SplunkSOARClient class. This configuration is susceptible to Man-in-the-Middle (MITM) attacks.

implementing-soar-automation-with-phantom