The Agent Skills Directory

[SAFE]: The skill provides standard cybersecurity forensic tools. The Python scripts scripts/agent.py and scripts/process.py use standard libraries (json, xml.etree.ElementTree) to parse structured log data and perform rule-based detection of known attack signatures (Event IDs 4662, 4769, 4768, etc.). No unauthorized network communication or command execution was detected.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Windows Event Logs (JSON/XML), which are untrusted data sources that could theoretically contain malicious strings intended for the analyzing agent.
Ingestion points: scripts/agent.py (JSON) and scripts/process.py (XML) ingest local files provided via command-line arguments.
Boundary markers: Absent; the scripts extract data from structured fields but do not explicitly wrap content in protective delimiters for the LLM context.
Capability inventory: The scripts are restricted to file-system reads for input and local file-system writes for JSON report generation. No eval(), exec(), or subprocess capabilities are present.
Sanitization: Input is parsed through standard Python JSON and XML libraries, ensuring structural validity before analysis.
[METADATA_POISONING]: There is a minor inconsistency between the author field in SKILL.md (mahipal) and the copyright notice in the LICENSE file (mukul975). However, since mukul975 is the verified vendor for this skill context, this is assessed as a metadata discrepancy rather than a malicious poisoning attempt.

performing-active-directory-compromise-investigation