The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes system utilities such as reg, schtasks, taskkill, and systemctl to audit and remediate infected environments. The accompanying Python scripts (agent.py, process.py) construct these commands using list-based arguments, adhering to security best practices to prevent shell injection vulnerabilities.
[PRIVILEGE_ESCALATION]: The eradication workflow involves operations that require high-level permissions, including terminating processes, deleting system registry keys, and resetting Active Directory account passwords. This is appropriate for the skill's intended use in incident response.
[INDIRECT_PROMPT_INJECTION]: The persistence scanning functionality ingests untrusted data from the local operating system (e.g., registry values, startup scripts) to detect malicious activity. This data is included in output reports, representing a surface for potential indirect instruction injection, though the scripts employ keyword-based filtering.
[EXTERNAL_DOWNLOADS]: The skill instructions include an example of performing an on-demand scan using the CrowdStrike Falcon API. This operation uses environment variables for secure token handling and targets a well-known security service endpoint.
[DYNAMIC_EXECUTION]: The provided scripts dynamically construct and execute system commands at runtime to perform remediation actions based on discovered artifacts, though they utilize safe implementation patterns to minimize risks.

eradicating-malware-from-infected-systems