The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents various command-line tools for forensic analysis, including Volatility 3, winpmem, LiME, and system utilities like dd and strings. These are standard tools used for investigating system memory.\n- [EXTERNAL_DOWNLOADS]: The documentation references downloading symbol tables from the official Volatility Foundation domain (volatilityfoundation.org). This is a required and safe step for accurate memory analysis.\n- [CREDENTIALS_UNSAFE]: Forensic techniques for extracting password hashes and LSA secrets (e.g., windows.hashdump) are described. These are legitimate capabilities intended for authorized security investigations.\n- [PRIVILEGE_ESCALATION]: Instructions specify the use of sudo or administrative privileges for memory acquisition tools, which is a necessary requirement for accessing physical RAM.\n- [INDIRECT_PROMPT_INJECTION]: The skill involves processing untrusted memory dumps. It mitigates risk by using external analysis tools (strings, grep, YARA) rather than processing data directly within the agent's primary prompt context.

memory-forensics