The Agent Skills Directory

[SAFE]: The skill serves its stated purpose as a malware IOC extraction tool. The included Python scripts (agent.py and process.py) perform standard forensic tasks such as generating cryptographic hashes (MD5, SHA-1, SHA-256) and parsing file headers using established libraries. The behavior is transparent and consistent with cybersecurity best practices.- [EXTERNAL_DOWNLOADS]: The script process.py contains functionality to query VirusTotal via its public API to enrich threat data. VirusTotal is a well-known and trusted service in the security community. The skill requires a user-provided API key and only transmits file hashes, not full file contents, which is standard procedure for malware analysis.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially malicious files, creating a surface for indirect prompt injection if the output were interpreted by an LLM without guardrails.
Ingestion points: Both scripts/agent.py and scripts/process.py read raw bytes or text from user-specified file paths for analysis.
Boundary markers: The tool does not use specific boundary markers as it is designed for low-level binary and string analysis.
Capability inventory: The tool can perform network GET requests to VirusTotal and write JSON analysis reports to the local filesystem.
Sanitization: The tool mitigates risks by using restrictive regular expressions for IOC extraction and explicitly filters out private IP addresses and common benign domains to ensure the quality and safety of the generated reports.

performing-malware-ioc-extraction