The Agent Skills Directory

[SAFE]: No malicious patterns or high-risk security issues were detected. The skill performs standard threat intelligence operations.
[COMMAND_EXECUTION]: The skill utilizes legitimate security administrative commands (e.g., suricata -T, suricatasc, wazuh-control) to validate and load generated detection rules. This is consistent with the primary purpose of the skill.
[EXTERNAL_DOWNLOADS]: The skill fetches dependencies and configurations from official and well-known repositories, including the MISP Project and SigmaHQ on GitHub. These are trusted sources for the security tools described.
[INDIRECT_PROMPT_INJECTION]: The skill implements a data ingestion pipeline for external threat intelligence feeds.
Ingestion points: External threat feeds ingested via the MISP REST API in scripts/agent.py and SKILL.md.
Boundary markers: Employs enforce_warninglist=True during searches to filter out known-good/benign indicators based on standard warninglists.
Capability inventory: The skill is capable of network communication (PyMISP API calls) and file system writes (generating .rules, .cdb, and .yml detection artifacts).
Sanitization: Uses yaml.safe_dump for generating Sigma rules, ensuring data is handled securely during serialization.

operationalizing-misp-threat-feeds