The Agent Skills Directory

[SAFE]: The skill provides purely instructional content and KQL query templates for Microsoft Defender for Endpoint. All provided code blocks are standard KQL used for security auditing purposes within the Microsoft ecosystem.\n- [SAFE]: The skill handles endpoint telemetry such as process command lines, network connections, and registry modifications. This data access is expected for the skill's primary purpose of security monitoring and incident response, and no patterns of unauthorized data exfiltration or credential theft were identified.\n- [SAFE]: The skill includes a structured framework for translating user-generated security hypotheses into KQL. This includes the use of mandatory headers and boundary markers that help separate instructions from the data being queried, mitigating the risk of indirect prompt injection.

microsoft-defender-endpoint