The Agent Skills Directory

[SAFE]: The skill consists entirely of documentation and instructional text. No executable scripts, system commands, or automated tasks are present that could be exploited for malicious activities.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external data from threat intelligence platforms, creating a potential but low-risk vulnerability surface. 1. Ingestion points: External IOC feeds including MISP, OpenCTI, and various commercial and open-source CTI vendors (SKILL.md). 2. Boundary markers: The instructions do not define specific delimiters or security warnings for the agent to apply to ingested feed content. 3. Capability inventory: The workflow involves updating SIEM lookup tables, EDR blocklists, and performing historical log retro-hunts. 4. Sanitization: The process includes deduplication and normalization of indicators, which provides basic structural validation but lacks explicit prompt injection sanitization.

ioc-hunter