skills/mukul975/anthropic-cybersecurity-skills/conducting-memory-forensics-with-volatility/Gen Agent Trust Hub
conducting-memory-forensics-with-volatility
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts/agent.py script utilizes subprocess.run to execute the vol (Volatility 3) command-line tool. Evidence: Found in scripts/agent.py within the run_volatility function where commands are constructed as a list: cmd = ["vol", "-f", memory_file, plugin]. This is a standard and secure method of execution as it avoids the use of shell=True.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of system memory dumps which could contain instructions or data designed to influence the agent's analysis. Ingestion points: The --memory-file argument in scripts/agent.py identifies the data source. Boundary markers: Absent; the script relies on Volatility 3's parsing logic. Capability inventory: Includes shell command execution (subprocess.run) and report generation (json.dump). Sanitization: Employs list-based execution to mitigate command injection risks.
Audit Metadata