The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the official Enterprise ATT&CK STIX data bundle from the MITRE organization's repository on GitHub. This is a recognized and trusted source for cybersecurity intelligence.
[COMMAND_EXECUTION]: Utilizes the curl utility to download data files and runs Python code to parse and query the datasets.
[PROMPT_INJECTION]: The skill metadata lists the author as 'mahipal', which differs from the provided context author 'oyi77'. This discrepancy in author metadata is noted as a potential consistency issue.
[PROMPT_INJECTION]: The 'Workflow' section includes instructions for exploitation and post-exploitation activities, which are offensive security tasks. While presented as a general workflow, these instructions could be interpreted as a directive to bypass standard AI safety constraints on harmful actions.
[PROMPT_INJECTION]: The skill processes external JSON data (enterprise-attack.json), creating a surface for indirect prompt injection.
Ingestion points: enterprise-attack.json (fetched via curl in SKILL.md)
Boundary markers: No delimiters or instructions to ignore embedded content were found
Capability inventory: Local file write operations (coverage_layer.json) and console output
Sanitization: Relies on the mitreattack-python library for parsing STIX content

mapping-mitre-attack-techniques