The Agent Skills Directory

[SAFE]: The skill provides instructions for installing and using standard, well-known forensic tools such as SleuthKit, TestDisk, and PhotoRec. All package installation commands target official operating system repositories or established project websites.
[SAFE]: The operational procedures defined in the skill follow forensic best practices, specifically emphasizing the use of read-only flags and hash verification to ensure evidence is not contaminated during analysis.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external disk images, which presents a surface for indirect prompt injection if the processed data contains malicious instructions targeting the agent.
Ingestion points: Forensic tools like fls, icat, and strings extract data from external disk images (evidence.dd) into the agent's context.
Boundary markers: None specified; the skill does not explicitly instruct the agent to use delimiters or ignore instructions found within the evidence files.
Capability inventory: The skill utilizes shell commands for file system analysis, data extraction, and directory management.
Sanitization: No specific sanitization or validation of the data extracted from the disk images is described. This is a standard risk for forensic tasks and is mitigated by the intended read-only use case.

re-disk-forensics