The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include commands to download the Autopsy forensic suite from its official GitHub repository and the National Software Reference Library (NSRL) hash database from NIST (s3.amazonaws.com/rds.nsrl.nist.gov). These are well-known and trusted sources in the digital forensics community.
[COMMAND_EXECUTION]: The Python agent in scripts/agent.py executes several Sleuth Kit command-line utilities such as mmls, fls, icat, and mactime. The script correctly implements security safeguards by using shlex.split to parse commands and subprocess.run with the default shell=False setting, which effectively prevents shell injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze forensic disk images, which are untrusted external data sources. While these images could theoretically contain malicious content designed to confuse an agent, the script's behavior is limited to data extraction and reporting to local files (JSON/CSV). It lacks explicit boundary markers for the data it processes, but given the forensic use case, the risk is inherent and the implementation does not introduce additional vulnerabilities.

analyzing-disk-image-with-autopsy