The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted data generated from malware execution, such as process logs, registry modifications, and network traffic. Malicious instructions could be embedded in the malware's activity (e.g., process names or simulated tool output) to influence the agent's analysis.
Ingestion points: Sandbox artifacts including behavior logs (PML/CSV), process snapshots, and network recordings from files mentioned in the Operational Steps.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided for the agent when processing tool output.
Capability inventory: The skill utilizes file system operations (saving logs via logman and Procmon) and extensive system inspection capabilities.
Sanitization: No specific sanitization or filtering of external malware-generated data is mentioned.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install various legitimate security tools.
Fetches Sysinternals tools from Microsoft's official channels.
References resources from the MITRE ATT&CK framework and Navigator tool on GitHub.
Instructs on downloading API Monitor from rohitab.com with a recommendation to verify checksums.
[COMMAND_EXECUTION]: The skill provides numerous system administration and diagnostic commands to inspect system state and investigate malware.
Uses Windows commands such as reg query, sc query, schtasks, and logman.
Uses Linux commands including sysdig, bpftrace, ps, and ss for behavioral monitoring.

re-behavior