The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of binary analysis tools and repositories from well-known security organizations and community projects.
Fetches the capa standalone binary and rules from Mandiant's official GitHub repository.
Installs the capa and unipacker packages via pip.
References the CAPEv2 sandbox project for dynamic analysis workflows.
[COMMAND_EXECUTION]: The skill utilizes several command-line utilities to perform binary triage and data processing.
Executes capa for static and dynamic analysis of executables.
Uses jq for parsing JSON output, grep for filtering results, and diff for comparing samples.
Employs upx and unipacker for decompressing packed malware samples during analysis workflows.
Includes a standard chmod +x command to enable execution of the downloaded capa binary.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary files and sandbox reports which could potentially contain embedded instructions or malicious metadata designed to influence agent behavior.
Ingestion points: The agent processes the output of capa when analyzing files like suspicious.exe or sandbox results in report.json (SKILL.md, Workflow 1; references/capability-driven-triage.md, CAPE Sandbox Dynamic Analysis).
Boundary markers: The skill does not explicitly define delimiters or instructions for the agent to ignore potentially adversarial content found within the binary analysis results.
Capability inventory: The skill provides the agent with access to shell execution for various analysis and package management tools (SKILL.md; references/capability-driven-triage.md).
Sanitization: No specific sanitization or filtering of the tool output is mentioned to prevent the agent from misinterpreting identified strings or rule names as commands.

capa