The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read and copy sensitive Windows configuration files, including the SYSTEM, SOFTWARE, and NTUSER.DAT registry hives, as well as system event logs. While this is the intended forensic purpose, these files contain sensitive system and user information.
[COMMAND_EXECUTION]: The skill provides workflows that execute shell commands to mount disk images and copy system-level files. These operations typically require high privileges and interact directly with the host filesystem.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data from external Windows registry hives and event logs provided in a forensic image (analyzed in SKILL.md and scripts/agent.py).
Boundary markers: No boundary markers or instructions to ignore embedded malicious content are present when processing these artifacts.
Capability inventory: The skill has the capability to read sensitive files, parse structured registry data, and write results to local JSON and CSV files.
Sanitization: The skill uses specialized libraries like regipy and python-registry for parsing, but it does not explicitly sanitize or validate the string values (e.g., FriendlyName, Serial Number) extracted from the registry before outputting them.

analyzing-usb-device-connection-history