The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts scripts/agent.py and scripts/process.py use subprocess.run to execute a wide array of system discovery tools, including netstat, tasklist, ip, and systemctl. These are used to capture the live state of the operating system.
[DATA_EXFILTRATION]: The skill automates the collection of sensitive system data, including all environment variables (via os.environ) and critical Windows Registry autostart keys. This data frequently contains secrets such as API keys, tokens, and credentials. The captured data is stored in a local evidence directory.
[PRIVILEGE_ESCALATION]: The skill requires and executes commands that typically require administrative or root privileges (e.g., insmod for kernel modules, netstat -b, and service queries). It facilitates the acquisition of deep system access for forensic purposes.
[INDIRECT_PROMPT_INJECTION]: The skill collects data from a potentially compromised host, such as process names, command lines, and network traffic metadata. This data is untrusted and could contain malicious instructions designed to influence an AI agent that analyzes the forensic logs.
Ingestion points: Evidence captured in scripts/agent.py and scripts/process.py from system commands and psutil.
Boundary markers: None; data is captured in its raw form to preserve forensic integrity.
Capability inventory: The skill has the ability to write to the filesystem and execute system discovery commands.
Sanitization: None; standard forensic practices require capturing data without modification, which precludes sanitization of potentially malicious strings in the system state.

collecting-volatile-evidence-from-compromised-host