The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches security detection content and threat intelligence from various repositories, including the official MITRE ATT&CK STIX bundle and repositories from Splunk, Elastic, and SigmaHQ.
[COMMAND_EXECUTION]: The skill utilizes npx to execute the security-detections-mcp and mcp-remote packages. It also uses shell commands like git and curl to retrieve external content during the manual setup process.
[INDIRECT_PROMPT_INJECTION]: The skill processes external detection rules and threat intelligence data which serves as a potential attack surface for indirect prompt injection.
Ingestion points: Local rule directories defined in environment variables such as SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, and CQL_HUB_PATHS.
Boundary markers: No specific delimiters or "ignore instructions" warnings are documented for the ingested rule content.
Capability inventory: The skill possesses capabilities for full-text search, rule retrieval, and automated detection generation based on ingested data.
Sanitization: No explicit sanitization or validation of the external content is described in the provided skill instructions.

security-detections-mcp