The Agent Skills Directory

[SAFE]: The skill acts as a legitimate security utility for container runtime monitoring. Its functionality is restricted to managing Falco configurations and summarizing security alerts.
[EXTERNAL_DOWNLOADS]: The skill references official Falco project repositories and Helm charts (e.g., falcosecurity.github.io). These are well-known and trusted sources for cloud-native security tooling.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Falco alert data, which represents a potential injection surface.
Ingestion points: scripts/agent.py reads Falco JSON alert logs via the parse_falco_alerts function.
Boundary markers: None; the tool expects standard line-delimited JSON alerts.
Capability inventory: Includes file writing (custom_falco_rules.yaml, falco_report.json) and HTTP GET requests to a local or configured Falco API endpoint.
Sanitization: Alerts are parsed using json.loads and stored in structured JSON reports, preventing raw log content from being executed or interpreted as commands.

performing-cloud-native-forensics-with-falco