The Agent Skills Directory

[DATA_EXFILTRATION]: The skill can read arbitrary file paths from the local filesystem based on user-provided input.
Evidence: In SKILL.md, the workflow takes an INPUT_FILE path and executes TEXT=$(cat "$INPUT_FILE").
Risk: This capability allows for the potential reading of sensitive system files, environment variables, or credentials if they are accessible to the agent.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to remote URLs provided by the user to fetch content for analysis.
Evidence: In SKILL.md, the command TEXT=$(curl -sL "$INPUT_FILE") fetches data from a user-controlled URL.
Risk: This introduces a risk of Server-Side Request Forgery (SSRF), allowing the agent to potentially probe internal network resources or fetch malicious data.
[COMMAND_EXECUTION]: The skill utilizes shell commands and Python here-docs to process and transform data.
Evidence: SKILL.md uses curl, cat, grep, wc, and multiple instances of `python3
<<'PYEOF'` to execute logic.
[PROMPT_INJECTION]: The skill processes untrusted external data (logs, files, or web content) and presents it to the agent, creating a surface for indirect prompt injection.
Ingestion points: The INPUT_SOURCE (file path, URL, or pasted text) processed in SKILL.md.
Boundary markers: Absent. The skill does not implement delimiters or safety instructions to prevent the agent from obeying commands embedded within the analyzed logs.
Capability inventory: The skill has network access (curl), filesystem access (reading logs/writing to /tmp), and shell execution capabilities.
Sanitization: The skill performs "defanging" (e.g., converting . to [.]), but this is a security formatting step for sharing IOCs and does not sanitize the input against malicious AI instructions.

ioc-extract