re-memdump
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions for the agent to analyze untrusted data sources including live process memory and core dump files.
- Ingestion points: SKILL.md and references/commands.md describe reading from /proc//mem and ELF core files.
- Boundary markers: Absent; the instructions do not explicitly warn the agent to avoid executing instructions found within the processed memory.
- Capability inventory: The skill utilizes shell commands (gcore, grep, strings, dd) and Python scripts to process the ingested memory data.
- Sanitization: Absent; data extracted from memory is processed and presented to the agent without escaping or validation.
- [SAFE]: The tool dependencies (Volatility 3, Sysinternals Procdump, DumpIt) and standard utilities (gdb, psmisc, procps, elfutils) are well-known software commonly used for legitimate forensic and security research purposes. The instructions for acquiring root privileges to bypass ptrace restrictions are standard requirements for memory access in these contexts.
Audit Metadata