The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the Volatility3 framework from its official GitHub repository and via the standard Python package manager.
Evidence: references/api-reference.md lists commands for pip install volatility3 and cloning the volatilityfoundation/volatility3 repository.
[COMMAND_EXECUTION]: The scripts/agent.py script executes the vol (Volatility3) command-line utility to perform memory analysis. The execution uses a list-based argument structure which mitigates shell injection risks.
Evidence: The _run_vol3 method in scripts/agent.py constructs a command list ["vol", "-f", self.memory_dump, plugin] and executes it using subprocess.run().
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary data from external memory dump files to identify exploitation patterns.
Ingestion points: The memory_dump file path provided via command-line arguments to scripts/agent.py.
Boundary markers: None identified.
Capability inventory: The skill has the capability to execute the vol command, write JSON reports, and dump process memory to the local file system as documented in scripts/agent.py.
Sanitization: No specific sanitization or escaping is applied to the binary data being read and analyzed during the pattern matching phase.

analyzing-heap-spray-exploitation