The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes multiple system utilities for disk forensics, including lsblk, fdisk, blockdev, hdparm, smartctl, dd, and dcfldd. These tools are necessary for the skill's stated purpose of acquiring bit-for-bit disk images.
[COMMAND_EXECUTION]: The Python script scripts/agent.py uses subprocess.run with shell=True to execute these forensic utilities. This implementation allows the script to utilize shell features such as pipes and the tee command for logging acquisition progress. The script performs string interpolation of device paths into these shell commands, which is expected for a local forensic utility.
[SAFE]: No remote code execution patterns, external downloads, or network operations were found in the scripts or documentation.
[SAFE]: The skill does not access sensitive user files (such as SSH keys or cloud credentials) and focuses entirely on block device acquisition as intended.
[SAFE]: All instructions and automation steps are transparent, well-documented, and follow standard forensic integrity best practices, such as hash verification and write-blocking.

acquiring-disk-image-with-dd-and-dcfldd