The Agent Skills Directory

[SAFE]: The skill is composed entirely of markdown instructions and reference files. It does not include any executable scripts, binary files, or tool configurations that could perform actions on a system. \n- [SAFE]: The guidelines incorporate defensive CTI standards, such as NATO-style source vetting (reliability and credibility axes), Traffic Light Protocol (TLP) for information sharing, and indicator defanging to prevent accidental execution of malicious artifacts. \n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest untrusted data from OSINT, commercial feeds, and ISAC shares (SKILL.md, collection_and_source_vetting.md). It addresses this surface risk through mandatory vetting procedures, instructions to separate analytic judgment from observations, and technical sanitization via indicator normalization and defanging. \n- [SAFE]: No patterns of prompt injection, obfuscation, or persistence were detected. The skill clearly defines its operational boundaries and refers to other specialized roles for active security operations like hunting or incident response.

cti-analyst