The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates several specialized reverse engineering utilities via subprocess calls. scripts/triage.py leverages Ghidra's analyzeHeadless utility for automated code analysis, while scripts/uefi_triage.py utilizes binary carving tools including binwalk, unblob, and UEFIExtract to process firmware images.
[EXTERNAL_DOWNLOADS]: scripts/cve_diff.py retrieves security advisory data from the Google OSV database, NIST's NVD API, and GitHub's advisory database. scripts/patchdiff_fetch.py automates the acquisition of official Windows binaries from Microsoft's symbol servers. These network operations target well-known and trusted infrastructure for security research and do not involve sensitive data exfiltration.
[REMOTE_CODE_EXECUTION]: scripts/cve_diff.py facilitates patch analysis by cloning remote git repositories. To mitigate risks, the script employs a scope guard to validate target domains and utilizes a hardened execution wrapper (git_safe) that disables git hooks, host configuration, and untrusted transport protocols during the cloning process.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the analysis of untrusted third-party binaries and firmware, creating a potential indirect injection surface.
Ingestion points: Untrusted data enters the agent context through the triage and firmware extraction scripts in scripts/triage.py and scripts/uefi_triage.py.
Boundary markers: The skill provides extensive documentation in SKILL.md and references/static-triage-decompilation.md mandating the use of isolated, snapshotted virtual machines for all analysis tasks.
Capability inventory: The toolchain possesses file-writing capabilities and shell execution for analysis purposes, which are restricted to the local research environment.
Sanitization: The skill relies on robust static analysis libraries like lief and pefile to parse binary structures rather than executing the untrusted content directly.

reverse-engineering