The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/extract_asr_exclusions.py uses subprocess.run to invoke external decompression tools (WDExtract.exe or wdextract) when processing Microsoft Defender signature files. This is a legitimate functional requirement for the script's purpose of carving exclusion paths from binary blobs.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes untrusted external binary data.
- Ingestion points: scripts/cfg_dispatch_gadget_finder.py (PE files), scripts/check_driver_blocklist.py (Driver files), and scripts/extract_asr_exclusions.py (Defender VDM signature blobs).
- Boundary markers: Absent. The scripts parse raw binary data and output findings directly to the console or files without explicit delimiters warning the agent about potential embedded instructions.
- Capability inventory: The skill includes subprocess.run in scripts/extract_asr_exclusions.py which can execute local binaries, and various PowerShell scripts that query system configuration.
- Sanitization: The author has implemented specific security best practices, such as XXE (XML External Entity) protection in scripts/check_driver_blocklist.py when parsing WDAC policies.
[SAFE]: The skill uses PowerShell's -ExecutionPolicy Bypass in its documentation and mitigation_recon.ps1 script, which is standard practice for security tooling to ensure scripts run regardless of local environment restrictions. All external references point to trusted organizations (Microsoft, IBM) and well-known security researchers.

windows-mitigations-bypass