The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted forensic evidence (disk images, registry hives, and logs) which presents an attack surface for indirect prompt injection if the processed data contains malicious instructions targeting the agent.
Ingestion points: Forensic Disk Images (E01, RAW, VHD, VMDK, AFF4), Windows Registry hives (SYSTEM), and filesystem artifacts as documented in SKILL.md and gemini.md.
Boundary markers: The skill directives mandate verifying acquisition cryptographic hashes (MD5 / SHA-256) before starting ingest modules in SKILL.md and gpt.md.
Capability inventory: The skill utilizes subprocess.Popen to launch the Autopsy executable, executes The Sleuth Kit CLI tools (mmls, fls, icat, istat), and writes artifacts to the Autopsy Blackboard SQLite/PostgreSQL database as described in SKILL.md, gemini.md, and gpt.md.
Sanitization: The skill instructions emphasize cross-referencing timestamps ($STANDARD_INFORMATION vs $FILE_NAME) to detect manipulation and verifying image integrity using cryptographic hashes.
[COMMAND_EXECUTION]: The skill utilizes system commands and subprocess calls to automate forensic tasks.
Evidence: SKILL.md and gpt.md provide command-line examples for TSK tools (mmls, fls, icat) and the Autopsy executable (autopsy64.exe).
Context: These commands are standard for digital forensics and incident response (DFIR) workflows and are used as intended for evidence triage and automation.
[DYNAMIC_EXECUTION]: The skill provides Python and Jython scripts for the user to save and execute locally to extend Autopsy's functionality.
Evidence: SKILL.md contains a Jython Ingest Module template, gemini.md contains a USB extractor script utilizing the python-registry library, and gpt.md contains a headless case builder script using subprocess.Popen.
Context: This is a standard method for providing automation scripts in forensic tools and is consistent with the skill's primary purpose.

autopsy