The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script performs forensic analysis by executing Windows utilities like wevtutil, reg, and powershell via subprocess.run. These calls use fixed argument lists to query system state and logs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted data from external sources.
Ingestion points: Reads content from Windows Event Logs (.evtx files) and the Windows Registry using scripts/agent.py.
Boundary markers: The script does not utilize explicit delimiters or 'ignore' instructions when outputting snippets of the ingested data.
Capability inventory: The script has the capability to execute shell commands (subprocess.run) and perform file system operations.
Sanitization: The script performs regex-based filtering to identify specific patterns and outputs results in a structured JSON format, but does not perform escaping on the logged data itself before presentation.
[METADATA_POISONING]: The SKILL.md file contains instructions to bypass antivirus warnings, labeling them as false positives. While this is a common malware technique, in the specific context of a security skill documenting malware signatures, it aligns with standard practice for handling signature-triggering research materials.

detecting-fileless-malware-techniques