The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents extensive command-line workflows for performing memory forensics. This includes the use of system utilities like dd and insmod, as well as specific forensic tools such as winpmem_mini_x64.exe, DumpIt.exe, and the Volatility framework (vol.py and vol). These commands are standard for the forensic domain.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external, untrusted memory images which could theoretically contain malicious artifacts or data patterns.
Ingestion points: Untrusted memory dumps (e.g., mem.raw, mem.lime) specified in SKILL.md and VOLATILITY_CHEATSHEET.md.
Boundary markers: Not present; the skill assumes the data will be processed by the Volatility framework without specific delimiters for the untrusted content.
Capability inventory: The skill leverages Volatility's full capability set, including process memory extraction, file carving, registry analysis, and credential dumping.
Sanitization: None specified; the skill relies on Volatility's internal parsing logic to handle complex memory structures.
[EXTERNAL_DOWNLOADS]: The skill references standard forensic acquisition tools including Microsoft's open-source AVML and other common utilities like WinPmem and DumpIt. These references are informative for the forensic workflow.

memory-forensics-volatility