The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py executes external tools such as vol (Volatility3) and rkhunter using the subprocess.run function. These calls are implemented using list-based arguments, which prevents shell command injection. This execution is fundamental to the skill's purpose of system analysis.
[EXTERNAL_DOWNLOADS]: The skill documentation in SKILL.md and references/api-reference.md directs users to install volatility3 via pip and download symbol tables from the official Volatility Foundation GitHub repository. These are trusted sources for security professionals.
[DATA_EXFILTRATION]: The skill accesses sensitive kernel information by reading /proc/modules, /sys/module, and physical memory dumps. While this involves high-privilege data access, it is a non-malicious requirement for rootkit detection and the data is processed locally.
[SAFE]: The skill follows standard forensic practices, such as cross-view analysis between kernel data structures and userspace utilities to identify discrepancies caused by malware.

analyzing-linux-kernel-rootkits