The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands and Python sub-scripts to perform forensic analysis. Activities include searching the filesystem for artifacts, capturing system memory (using tools like Volatility and LiME), and parsing Windows Event Logs (.evtx files). These actions are consistent with the skill's stated purpose in a cybersecurity incident response context.
[EXTERNAL_DOWNLOADS]: The scripts/agent.py file contains functionality to interact with well-known cybersecurity services including VirusTotal and ID Ransomware for file hash lookups and variant identification. These network operations target official API endpoints.
[PROMPT_INJECTION]: The skill processes untrusted external data, specifically ransom notes and Windows Event Logs, which introduces a potential surface for indirect prompt injection if an attacker embeds instructions within these artifacts.
Ingestion points: scripts/agent.py (reads ransom note content via Path.rglob), SKILL.md (parses Security.evtx and ransom notes).
Boundary markers: Absent. The skill does not explicitly use delimiters or instructions to ignore commands within the analyzed data.
Capability inventory: The skill has the capability to execute shell commands (find, cp, vssadmin), perform network requests (VirusTotal API), and write reports to the local filesystem.
Sanitization: The skill uses regular expressions to extract specific data (Bitcoin addresses, IPs), which provides some validation, but the raw content of notes is printed to logs/reports without sanitization.

investigating-ransomware-attack-artifacts