The rule detects a new AI agent skill installation attempt by monitoring Windows process_creation events for node.exe launching with the NPX-based skills mechanism. Specifically, it looks for a node.exe process (Image and OriginalFileName) whose command line contains npx-cli.js, skills, and add, indicating an attempt to install a new skill for an AI agent. This can enable attackers to inject or enable capabilities that run within the agent on behalf of the user. Analysts should review any installed skills to verify legitimacy, version, and publisher, and adjust detection based on whether AI agent tooling is sanctioned in the environment. In environments where such tooling is allowed, tune alert levels and consider allowlisting legitimate skill installations to reduce false positives; in non-permitted environments, treat as high-risk and investigate promptly. Note: The rule’s effectiveness depends on environment policy around NPX-based agent skills and Node.js usage.