The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various shell and PowerShell commands to identify .NET runtimes (CoreCLR vs NativeAOT) using utilities like strings, nm, dumpbin, and readlink. It also executes collection tools such as dotnet-dump, gcore, and procdump to capture process memory.
[EXTERNAL_DOWNLOADS]: The skill references and downloads diagnostic utilities from official Microsoft and .NET sources. Specifically, it fetches procdump from download.sysinternals.com and references dotnet-dump via github.com/dotnet. These are recognized as trusted external sources.
[PRIVILEGE_ESCALATION]: Instructions include high-privilege operations necessary for dump collection, such as modifying the kernel.core_pattern via sudo, adding SYS_PTRACE capabilities to containers, and creating Windows Registry keys in HKLM for Windows Error Reporting. These are legitimate administrative actions required for the skill's stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from binary files and process modules (e.g., via strings or Get-Process). While this represents a data ingestion surface, the risk is minimal as the data is used solely for runtime identification and is not interpolated into logic-heavy prompts.

dump-collect