The Agent Skills Directory

[SAFE]: The skill is a functional incident response tool designed to help security analysts investigate cloud audit logs. Its operations are consistent with its stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes external cloud audit logs, which creates a potential surface for indirect injection if attackers can control resource names or user agents.
Ingestion points: SKILL.md (via search_cdr_events, get_alert, and get_asset_related_alerts_summary).
Boundary markers: None specified in the instructions.
Capability inventory: The skill can generate and write remediation files (e.g., .tf, .sh, .yml) to the local filesystem.
Sanitization: No explicit log data sanitization is mentioned.
[DYNAMIC_EXECUTION]: The skill generates infrastructure-as-code and shell scripts (Terraform, Ansible, Shell, etc.) based on investigation results for the user to implement containment.

orca-investigate