The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs legitimate forensic analysis libraries, specifically analyzeMFT and pyusn, from the Python Package Index (PyPI). \n- [COMMAND_EXECUTION]: The skill executes several external command-line utilities from The Sleuth Kit (including blkls, fls, icat, istat, and fsstat) and Eric Zimmerman's forensic toolset (MFTECmd.exe) to process disk images and extract metadata. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted forensic data, such as strings recovered from slack space and filenames from the Master File Table (MFT). This creates a vulnerability surface where malicious instructions embedded within the analyzed evidence could potentially be interpreted by an AI agent during the reporting phase. \n
Ingestion points: Raw disk images (evidence.dd), extracted MFT files, and USN Journal records (SKILL.md, scripts/agent.py). \n
Boundary markers: Absent; the skill extracts and processes data without specialized delimiters to isolate evidence content from instructions. \n
Capability inventory: The agent can execute shell commands via subprocess and write forensic reports to the file system. \n
Sanitization: The scripts use basic error handling during string decoding (errors=\"replace\") but do not implement content-based filtering for malicious prompts.

analyzing-slack-space-and-file-system-artifacts