The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the official Enterprise ATT&CK STIX bundle from MITRE's GitHub repository.
Evidence: curl -o enterprise-attack.json https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json in SKILL.md.
Context: The source is the official repository for MITRE ATT&CK data, which is a well-known and trusted service in the cybersecurity domain.
[COMMAND_EXECUTION]: The skill requires the use of shell commands to manage data and dependencies.
Evidence: pip install mitreattack-python for the official library and curl for downloading the STIX data bundle.
Context: These commands are used for legitimate setup and data acquisition for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where it ingests external data that could theoretically contain malicious instructions.
Ingestion points: The scripts/agent.py script loads detection rules from a JSON file (detection_rules.json).
Boundary markers: None observed in the prompt interpolation logic.
Capability inventory: File system writing (generating Navigator layers) and network operations via curl.
Sanitization: The script treats the input as structured JSON data, extracting specific fields (attack_ids) rather than processing free-text instructions.

mapping-mitre-attack-techniques