The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of numerous forensics commands via the Volatility 3 framework to inspect process lists, network states, and system metadata within memory images.
[EXTERNAL_DOWNLOADS]: The skill describes downloading essential forensics libraries and dependencies from well-known registries, specifically PyPI for packages like volatility3, pycryptodome, and yara-python. It also notes the automatic acquisition of debugging symbols (PDBs) from Microsoft's official symbol servers to ensure accurate memory analysis.
[CREDENTIALS_UNSAFE]: Provides methods for extracting local account hashes (SAM/SYSTEM) and LSA secrets (SECURITY) from memory dumps. These actions are primary functions of forensic analysis intended for incident response and evidentiary documentation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from memory dumps, which presents a surface for potential instruction injection if the dump contains specifically crafted content.
Ingestion points: Memory dump files (.raw, .mem, .core, .vmem) processed by vol plugins described in SKILL.md.
Boundary markers: No specific delimiters or warnings are used to separate ingested forensic data from the agent's operational instructions.
Capability inventory: Shell command execution for forensic toolsuites and system package managers (apt, brew, pip).
Sanitization: The skill does not define specific sanitization or filtering logic for the data extracted from memory images before it is interpreted by the agent.

re-mem-forensics