The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates a wide range of industry-standard forensic tools (including Velociraptor, KAPE, UAC, Volatility 3, Chainsaw, and Hayabusa) through subprocess orchestration in Python and shell/PowerShell scripts. These operations are essential for its primary function of forensic triage and investigation.
[INDIRECT_PROMPT_INJECTION]: As a forensic tool, the skill is designed to ingest and process untrusted data from memory dumps, event logs, and Git repository objects. To mitigate the risk of processing malicious metadata, scripts like dangling_commit_finder.py include dedicated sanitization functions to neutralize control characters, zero-width Unicode characters, and other terminal-spoofing sequences in untrusted strings.
[PRIVILEGE_ESCALATION]: Forensic acquisition of volatile data (e.g., RAM dumps, raw disk access) inherently requires administrative or root privileges, which the skill handles by documenting the need for elevated execution. The cloud IR script also facilitates legitimate containment actions, such as revoking identity tokens and applying restrictive IAM policies, which are gated by explicit user confirmation flags.
[EXTERNAL_DOWNLOADS]: The skill references and fetches resources from well-known and reputable sources, such as the SigmaHQ ruleset on GitHub and forensic activity mirrors like GH Archive and the GitHub Events API. These references are used to pull detection logic and historical metadata for repo-compromise investigations.

incident-response