The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard Windows and third-party utility binaries to perform its operations. This includes robocopy.exe for resilient file copying, 7z.exe (7-Zip) for NTFS image extraction, ddrescue.exe (GNU ddrescue) for bit-level drive imaging, and smartctl.exe for storage health monitoring. These tools are invoked with array-based arguments to prevent command injection.
[EXTERNAL_DOWNLOADS]: The documentation references industry-standard forensic and recovery tools from external sources, such as PECmd by Eric Zimmerman and ddrescue via the Cygwin project. These are provided as recommendations for advanced diagnostics and data recovery; the skill does not automate the download or installation of these tools.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection as it ingests and displays potentially untrusted data from the system, including Event Log messages, file system paths, and process command lines.
Ingestion points: Data enters the agent's context through Get-WinEvent (System/Security logs), Get-ChildItem (file paths), and Get-Process (command line arguments).
Boundary markers: The scripts use a structured terminal design system (via term.ps1) to present findings in clearly delimited panels, which helps differentiate system data from agent instructions.
Capability inventory: The skill has significant capabilities, including file system writes (copy-tree.ps1), registry modifications (safe-disable-startup.ps1), and the ability to execute external binaries.
Sanitization: The scripts implement Format-EventMessage and Format-Cmd helpers which truncate strings and collapse whitespace, providing a basic layer of protection against embedded instructions in log data.

windows-ops