The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line patterns for executing specialized security and forensics tools including chainsaw, hayabusa, volatility3, log2timeline, and psort.py for system analysis.
[CREDENTIALS_UNSAFE]: Instructions include specific commands for extracting sensitive password hashes and LSA secrets from Windows memory dumps using Volatility 3 plugins such as hashdump, lsadump, and cachedump.
[DATA_EXFILTRATION]: The skill directs the agent to access and collect highly sensitive forensic artifacts, including raw memory images, full disk images (e.g., /dev/sda), and system authentication logs. These operations are conducted for local analysis without any indicated network exfiltration.
[PROMPT_INJECTION]: The skill functions as a surface for indirect prompt injection by instructing the agent to process and analyze external forensic data (logs, memory, and disk artifacts) which may contain attacker-controlled content.
Ingestion points: The skill analyzes Windows Event Logs (.evtx), memory images, and full disk images in SKILL.md.
Boundary markers: No specific delimiters or instructions are provided to the agent to treat analyzed data as untrusted or to ignore embedded instructions.
Capability inventory: The skill maintains high-privilege capabilities including disk read access and the execution of complex forensic command-line tools.
Sanitization: No sanitization or integrity validation of the analyzed forensic evidence is specified.

incident-response