The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the download of Active Directory auditing tools from reputable sources. It fetches PingCastle from the Netwrix GitHub repository, SharpHound from the SpecterOps GitHub repository, and Purple Knight from the official Semperis domain. These are well-known security vendors and open-source projects.
[COMMAND_EXECUTION]: The instructions include PowerShell commands for executing downloaded security binaries (e.g., PingCastle.exe, SharpHound.exe) and deploying BloodHound using Docker Compose. These actions are standard for the stated purpose of performing security assessments.
[INDIRECT_PROMPT_INJECTION]: The utility scripts agent.py and process.py ingest data from external sources to generate consolidated reports.
Ingestion points: agent.py parses PingCastle XML reports via xml.etree.ElementTree, and process.py parses both PingCastle XML and BloodHound JSON exports.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the parsing logic.
Capability inventory: The parsed data is used solely for data aggregation, scoring, and generating a JSON report; there are no executable sinks (like eval() or subprocess.run()) that utilize the parsed content.
Sanitization: The scripts rely on standard Python library parsers for XML and JSON validation.

performing-active-directory-vulnerability-assessment