The Agent Skills Directory

[SAFE]: The skill performs local forensic analysis of Windows Prefetch files using the windowsprefetch library to identify execution timelines, run counts, and potential malware masquerading.
[SAFE]: The provided Python script, scripts/agent.py, operates entirely on the local filesystem. It contains no network communication code, data exfiltration logic, or hidden credential harvesting patterns.
[SAFE]: The external library windowsprefetch and the referenced documentation (e.g., SANS, Eric Zimmerman's tools) are well-regarded and standard resources in the digital forensics and incident response (DFIR) community.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted system metadata from Prefetch files, which creates a theoretical surface for indirect prompt injection, though the risk is assessed as safe given the tool's intended forensic context.
Ingestion points: scripts/agent.py reads file metadata and execution parameters from .pf files located in a user-provided directory.
Boundary markers: The findings are exported in a structured JSON format; however, the skill does not wrap the output in specific LLM delimiters or instruction-ignore warnings.
Capability inventory: The script's capabilities are restricted to local file read operations and writing analysis reports to a local directory.
Sanitization: No sanitization is performed on the extracted executable names or volume paths, as the tool is designed to provide raw forensic data for analyst review.

analyzing-windows-prefetch-with-python