The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script and SKILL.md instructions utilize subprocess.run and shell commands to invoke system utilities for disk imaging, including dd, dcfldd, lsblk, fdisk, blockdev, hdparm, and smartctl. These operations are fundamental to the skill's forensic acquisition purpose.
[PRIVILEGE_ESCALATION]: Documentation correctly identifies that root or sudo privileges are mandatory for accessing block devices and enabling software write protection via blockdev. The agent script performs checks and requires administrative access to execute its core forensic functions.
[INDIRECT_PROMPT_INJECTION]: The agent script ingests system metadata by parsing JSON output from lsblk and interpolates device names into system command arguments. While the script uses shlex.split and list-based subprocess.run calls to mitigate injection risks, the ingestion of external system-provided data represents a standard attack surface for indirect instructions.
[EXTERNAL_DOWNLOADS]: The documentation includes instructions to install the dcfldd utility using the standard Linux package manager (apt-get). This is a reference to an official repository for a standard forensic tool.

acquiring-disk-image-with-dd-and-dcfldd