The Agent Skills Directory

[SAFE]: The skill includes boilerplate configurations for Logstash using its domain-specific language (DSL). These examples cover common tasks such as Grok parsing, field mutation, and outputting to Elasticsearch.
[EXTERNAL_DOWNLOADS]: The skill references a Docker image from docker.elastic.co, which is the official registry for Elastic (a well-known service). This reference is informative and does not execute untrusted remote code.
[INDIRECT_PROMPT_INJECTION]: The skill defines pipelines that ingest untrusted data from network inputs (Beats on port 5044, TCP on port 5000, and Kafka topics).
Ingestion points: Data enters via the beats, tcp, and kafka input plugins defined in SKILL.md.
Boundary markers: The configuration does not explicitly define boundaries between untrusted data and instructions, which is standard for Logstash DSL.
Capability inventory: The skill uses standard Logstash filters (grok, mutate, fingerprint) and outputs to Elasticsearch. No arbitrary command execution (exec) or network exfiltration to unknown domains is present.
Sanitization: The use of grok patterns and the fingerprint (SHA256) filter provides structured parsing and integrity checking for the ingested data.

logstash