The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py file uses the subprocess module to execute external tools like vol (Volatility3) and rkhunter. This is a core part of the skill's functionality for performing forensics and system scans.
[INDIRECT_PROMPT_INJECTION]: The skill processes output from external forensic tools, which represents a potential attack surface if the system being analyzed has been compromised by a rootkit designed to subvert detection by producing malicious or deceptive tool output.
Ingestion points: Data is ingested from the stdout of vol and rkhunter in scripts/agent.py.
Boundary markers: None. The skill assumes the output from these security tools is structured (JSON) or follows specific warning patterns.
Capability inventory: The skill can read system files (/proc/modules), list directory contents (/sys/module), and execute subprocesses.
Sanitization: The script uses json.loads for Volatility output and basic string filtering for rkhunter output.
[EXTERNAL_DOWNLOADS]: The documentation and script reference downloading symbol tables (ISF) from the Volatility Foundation's GitHub repository, which is a standard procedure for memory forensics.
[PRIVILEGE_ESCALATION]: The skill documentation includes examples using sudo. This level of access is expected and necessary for the agent to perform kernel-level rootkit analysis and access protected memory structures.

analyzing-linux-kernel-rootkits