The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network requests to well-known security services, including VirusTotal, URLScan.io, and MalwareBazaar, for threat intelligence enrichment. These are standard operations for cybersecurity incident response and target reputable domains.
[COMMAND_EXECUTION]: The skill documentation provides PowerShell commands for administrative actions such as purging emails from mailboxes and resetting user passwords. These are identified as manual containment steps within a SOC workflow and do not involve unauthorized or hidden execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from phishing emails (.eml files). While this constitutes an attack surface, the logic is limited to structured extraction of headers and indicators (URLs, hashes) for analysis, which mitigates the risk of the agent executing malicious instructions embedded in the email content.

investigating-phishing-email-incident