The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's Python scripts utilize the standard 'requests' and 'pyyaml' libraries for API communication and YAML parsing. These are well-known, legitimate dependencies from official package registries.\n- [CREDENTIALS_UNSAFE]: The audit agent script correctly manages sensitive Cortex XSOAR API keys by retrieving them from the environment variables (XSOAR_API_KEY) rather than using hardcoded values, which is a recommended security practice for secret management.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it ingests data from the Cortex XSOAR API (e.g., incident names, playbook descriptions).\n
Ingestion points: Data is fetched from XSOAR API search endpoints in 'scripts/agent.py'.\n
Boundary markers: Audit reports do not utilize specific delimiters to isolate external metadata from system instructions.\n
Capability inventory: The agent can perform authenticated network requests to a user-configured URL and save output to the local file system.\n
Sanitization: Data retrieved from the API is displayed without sanitization or escaping, which is common for administrative audit tools.\n- [COMMAND_EXECUTION]: The script allows users to bypass TLS verification via an environment variable (SKIP_TLS_VERIFY). While this is a standard feature for supporting self-signed certificates in internal security environments, it is noted as a potential security risk if used over untrusted networks.

implementing-soar-playbook-with-palo-alto-xsoar