The Agent Skills Directory

[SAFE]: The skill acts as a documentation framework and instructional guide for threat hunting. It does not contain executable code, scripts, or commands that could cause harm to the host environment.
[SAFE]: No obfuscation, encoding, or hidden content was detected within the documentation or logic sections.
[SAFE]: External references (e.g., to MITRE ATT&CK or various security platforms) are used strictly for context and methodology alignment.
[SAFE]: The skill does not attempt to access sensitive files, environment variables, or hardcoded credentials.
[SAFE]: The handling of external intelligence sources is mediated through the ABLE framework (Actor, Behaviour, Location, Evidence), which provides a structured schema that naturally mitigates basic prompt injection risks by requiring the agent to decompose inputs into specific, predefined categories.
Ingestion points: External security intelligence reports and source references (Step 1, Step 7).
Boundary markers: The instructions use structured YAML templates and ABLE tables to process external content.
Capability inventory: The skill guides the authoring of queries for external platforms (KQL, SPL) but does not execute them directly within this context.
Sanitization: Methodological decomposition acts as a logical filter for processed data.

threat-hunting