The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation provides instructions to download established security tools from well-known repositories on GitHub, including those from GhostPack (SharpDPAPI), gentilkiwi (Mimikatz), and Fortra (Impacket). These sources are recognized within the cybersecurity community as official providers of red-teaming and forensics utilities.
[COMMAND_EXECUTION]: The orchestration script scripts/agent.py utilizes the subprocess.run function to execute external binaries like SharpDPAPI.exe and impacket-dpapi. The script correctly passes command arguments as a list to prevent shell injection and serves as a functional wrapper for local tool execution.
[DATA_EXFILTRATION]: The skill and its associated scripts are designed to access sensitive Windows directories, such as %APPDATA%\Microsoft\Protect and %LOCALAPPDATA%\Microsoft\Credentials, to recover DPAPI-protected secrets. This access is the explicit and stated objective of the skill for credential recovery during authorized security assessments.
[SAFE]: The skill exhibits best practices for security-related content, including clear legal notices, mapping to NIST CSF and MITRE ATT&CK frameworks, and providing transparent operational guidance for authorized use cases.

abusing-dpapi-for-credential-access