The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Windows LNK files and Jump Lists, which are external artifacts that could be manipulated by an attacker to include deceptive metadata. While not a direct exploit, this represents a vulnerability surface where the extracted text could influence an AI's interpretation of a forensic timeline if processed without sanitization.\n
Ingestion points: Forensic artifacts (LNK, AutomaticDestinations, CustomDestinations) collected from system paths (SKILL.md, Step 1).\n
Boundary markers: Absent. Metadata is extracted and formatted into CSV or text outputs without specialized delimiters for downstream LLM analysis.\n
Capability inventory: The skill utilizes file system write operations for reporting and shell utilities (mount, cp, find) for collection.\n
Sanitization: The Python logic uses standard string conversion for extracted fields, which provides basic type safety but does not validate field content against malicious instruction patterns.\n- [COMMAND_EXECUTION]: The workflow involves the execution of shell commands to mount forensic images and copy artifacts. These operations are standard for the digital forensics domain but require administrative context for mounting evidence files.

analyzing-windows-lnk-files-for-artifacts