The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the shell tool to invoke the splsearch CLI. This is the core functionality of the skill, used for executing searches, managing local result tables, and performing data analysis. The usage is strictly defined and limited to subcommands provided by the vendor tool.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the skill interacts with sensitive log data, it contains robust safety instructions. It explicitly forbids the agent from printing cookies, authentication files, or tokens, and directs the agent not to ask for passwords. Data is stored in a local SQLite file (~/.config/splsearch/results.sqlite) rather than being transmitted to unknown third parties.
[DYNAMIC_EXECUTION]: The skill performs local SQL queries using 'splsearch result-search' against the retrieved datasets. This dynamic execution is bounded to the local results database and is a standard feature for filtering and summarizing incident evidence without executing code on the host system or the remote Splunk instance.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a consumer of external log data, which is an ingestion point for untrusted content. The skill design mitigates this risk by requiring local summarization and structured data reduction (e.g., via SQL or aggregations) before presenting evidence to the main agent context.

splunk-search