The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/agent.py facilitates the execution of forensic tools such as log2timeline.py, psort.py, and psteal.py. It follows security best practices by passing arguments as a list to the subprocess.run function, which prevents shell injection vulnerabilities. This functionality is essential to the skill's primary purpose.
[EXTERNAL_DOWNLOADS]: The skill refers to official and trusted sources for tool installation, including the log2timeline Docker Hub repository and the GIFT PPA for Ubuntu. These downloads are associated with established organizations in the digital forensics community.
[PROMPT_INJECTION]: The skill has an inherent surface for indirect prompt injection due to its core function of processing untrusted forensic artifacts such as disk images and system logs.
Ingestion points: External evidence sources (e.g., forensic images at /cases/image.E01) read by the processing scripts.
Boundary markers: No explicit boundary markers or delimiters are present in the provided scripts to differentiate untrusted data from the agent's instructions.
Capability inventory: The skill has the capability to read from the file system and execute forensic command-line tools and the Timesketch importer.
Sanitization: No sanitization or filtering of the content within the forensic artifacts is performed by the provided wrapper script.

building-super-timelines-with-plaso