The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches a setup script from the Red Canary GitHub repository (redcanaryco/invoke-atomicredteam) and executes it using the PowerShell Invoke-Expression command.
[COMMAND_EXECUTION]: The skill facilitates the execution of adversary emulation tests using the Invoke-AtomicTest PowerShell module, which can modify system state or trigger alerts.
[DYNAMIC_EXECUTION]: The provided agent.py script constructs a PowerShell script (retest_blind_spots.ps1) by embedding technique identifiers and names parsed from external YAML files into execution commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Atomic Red Team YAML definitions and SIEM detection results to generate reports and execution scripts.
Ingestion points: Data is read from local YAML and JSON files via the load_atomics_inventory and load_detection_results functions in scripts/agent.py.
Boundary markers: No specific delimiters are implemented in the generated PowerShell output to isolate data-derived strings from the execution template.
Capability inventory: The generated script is designed for execution in a PowerShell environment where Invoke-AtomicRedTeam is installed.
Sanitization: Technique identifiers are parsed using yaml.safe_load but are interpolated into the executable retest script without further sanitization.

performing-purple-team-atomic-testing