The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line examples for memory acquisition and analysis. This includes commands requiring elevated privileges such as sudo insmod, sudo dd, and sudo cp /proc/kcore on Linux, and administrative execution of tools like winpmem_mini_x64.exe on Windows.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted binary data from memory dumps and external YARA rule files, creating a surface for indirect prompt injection.
Ingestion points: Memory dump files (e.g., memory.raw, memory.lime), process memory dumps, and YARA rule files (rules.yar, malware.yar).
Boundary markers: No explicit boundary markers or instructions to ignore embedded content are provided when the agent is asked to analyze strings or tool outputs.
Capability inventory: The skill utilizes subprocess execution for several tools including volatility, strings, grep, floss, dd, and insmod. It also performs file reads/writes for analysis artifacts.
Sanitization: There is no evidence of sanitization or filtering of the output generated from tools like strings or volatility before the agent processes the results.

memory-forensics