The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Mentions downloading the Velociraptor binary from the official project repository on GitHub and references other official security tool documentation.
[COMMAND_EXECUTION]: Provides instructions for executing velociraptor CLI commands to perform endpoint forensic collection and server configuration.
[DATA_EXFILTRATION]: Includes extensive VQL (Velociraptor Query Language) query patterns for collecting endpoint telemetry, including event logs, registry keys, and file metadata. This is part of the core intended functionality for forensic evidence preservation.
[REMOTE_CODE_EXECUTION]: The assets/ci-config-template.yml file contains a template for installing tfsec via a piped bash command from Aqua Security's official GitHub repository, which is a standard operational pattern for security tool deployment.
[NO_CODE]: The SKILL.md file references several scripts (e.g., vql_query_builder.py, artifact_validator.py) in a scripts/ directory that are not present in the provided skill package.

ir-velociraptor