The Agent Skills Directory

[COMMAND_EXECUTION]: Executes common forensic utilities including md5sum, sha1sum, sha256sum, ssdeep, and tshark to analyze malware samples and network captures.
[EXTERNAL_DOWNLOADS]: Communicates with the VirusTotal API (virustotal.com) to enrich and validate extracted indicators. This is an established security service and the communication is consistent with the skill's stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inputs, specifically malware binaries and automated sandbox reports, to extract forensic artifacts.
Ingestion points: malware_sample.exe (via string extraction in scripts/agent.py) and cuckoo_report.json (in SKILL.md).
Boundary markers: Absent; the tool generates structured report files from the extracted data.
Capability inventory: File system read/write, network access (VirusTotal), and execution of forensic CLI tools (documented in scripts/agent.py and SKILL.md).
Sanitization: Includes a defang_ioc function to neutralize extracted URLs and IPs.

extracting-iocs-from-malware-samples