The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill requires and instructs the agent to ensure high-privilege execution environment.
Evidence includes mandatory use of the /admin=1 flag for WizTree to perform raw NTFS MFT parsing.
Automation scripts in gpt.md are designed to run under the NT AUTHORITY\SYSTEM account with RunLevel Highest to bypass access restrictions.
The skill also provides commands for system-level modifications such as disabling hibernation (powercfg -h off) and purging the Windows component store (DISM).
[PERSISTENCE]: The skill documents and provides scripts for establishing persistence on the host system.
gpt.md contains a PowerShell script (Invoke-WizTreeAudit.ps1) and instructions to register it as a daily persistent task using Register-ScheduledTask in the Windows Task Scheduler.
[DATA_EXFILTRATION]: The skill includes functionality for sending disk analytics data to external services.
gpt.md provides code to dispatch storage alerts via webhooks using Invoke-RestMethod. While the provided URL is a placeholder, this mechanism is designed to exfiltrate drive capacity information and lists of top files to external endpoints (e.g., Discord/Slack).
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection through the processing of externally generated data.
Ingestion points: The skill reads CSV reports generated by WizTree using pd.read_csv in SKILL.md and Import-Csv in gpt.md.
Boundary markers: None identified; there are no explicit instructions to ignore embedded content in the ingested data.
Capability inventory: The skill has significant capabilities including executing shell commands (subprocess.run, Start-Process), managing scheduled tasks, and performing network requests (Invoke-RestMethod).
Sanitization: No evidence of data sanitization or validation of the CSV content before it is processed or used in subsequent logic.
[COMMAND_EXECUTION]: The skill generates and executes several system commands and scripts.
It utilizes subprocess.run in Python and Start-Process in PowerShell to interact with the underlying operating system and WizTree binaries.

wiztree