The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches threat intelligence data from well-known and trusted services including VirusTotal, AbuseIPDB, Shodan, and GreyNoise to enrich security indicators.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Indicator of Compromise (IOC) values such as IPs, domains, and file hashes from external incident data or user input.
Ingestion points: The iocs list in SKILL.md and the ioc_value argument in the IOCEnrichmentAgent class within scripts/agent.py.
Boundary markers: None identified; IOC values are interpolated directly into API request URLs or parameters.
Capability inventory: The skill performs network operations via the requests library and official clients for VirusTotal and Shodan.
Sanitization: No specific validation or sanitization of IOC strings is performed before inclusion in network requests, which is standard for lookup tools but creates a surface for processing untrusted data.
[CREDENTIALS_UNSAFE]: The script and documentation facilitate the use of API keys for various intelligence providers. While no actual secrets are hardcoded, the script is designed to accept keys as command-line arguments, which can be visible in system process logs.

performing-ioc-enrichment-automation