The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to utilize several forensic and network diagnostic tools to investigate incidents, including volatility for memory analysis, tcpdump for network traffic capture, and system commands like ps and ss to inspect running processes and network states.
[PRIVILEGE_ESCALATION]: The skill documentation explicitly guides the agent to seek root or administrative privileges when necessary to perform essential forensic tasks such as capturing system memory dumps and creating disk images.
[EXTERNAL_DOWNLOADS]: The skill references external resources and specialized software from well-known security organizations, including the Volatility Foundation, Autopsy, and NIST, to support the incident response lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data sources which introduces a potential surface for indirect prompt injection attacks.
Ingestion points: System logs, application error logs, and database access logs located in ${CLAUDE_SKILL_DIR}/logs/, as well as network PCAP files.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the analyzed logs.
Capability inventory: The skill has the ability to execute shell commands for forensic analysis and perform file system operations.
Sanitization: There is no evidence of automated filtering or sanitization of external log content before it is parsed by the agent.

responding-to-security-incidents