The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a 'Prompt Injection Safety Notice' (Section 8) that contains defensive keywords such as 'ignore previous instructions'. These are used to explicitly instruct the agent to treat such phrases as data for analysis when encountered in untrusted logs or reports, effectively hardening the agent against injection attacks.
[DATA_EXFILTRATION]: The skill documentation mandates safe data handling practices, instructing the agent to never exfiltrate sensitive environment values (e.g., IP addresses, hostnames, usernames) found during analysis and to redact or generalize them in the output.
[REMOTE_CODE_EXECUTION]: The skill references established security tools and repositories, such as Atomic Red Team and the SigmaHQ repository, as part of a manual validation process. It does not contain instructions for automated or piped remote code execution.
[COMMAND_EXECUTION]: The skill utilizes standard file-system tools (Read, Grep, Glob) for analyzing text-based log files and configuration. It includes a Base64-encoded string in a validation example (ZQBjAGgAbwAgACIAdABlAHMAdAAiAA== which decodes to echo "test"), which is used neutrally for testing detection logic.

detection-engineering