The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads specialized forensic tools from GitHub repositories. It fetches the Chainsaw analysis tool from the WithSecureLabs repository and the Hayabusa timeline generator from the Yamato-Security repository. Both sources are well-known security research organizations.
[COMMAND_EXECUTION]: The skill executes downloaded binaries and system commands to perform its forensic duties. It runs the Chainsaw and Hayabusa binaries to process event logs and uses standard system utilities like mount and unzip for evidence handling.
[PRIVILEGE_ESCALATION]: The instructions include commands that typically require elevated permissions. The mount command used to attach forensic images requires root or sudo access, which is standard practice in digital forensics to access filesystem artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for processing untrusted data found in event logs. Ingestion points: scripts/agent.py and SKILL.md scripts ingest binary EVTX files from potentially compromised systems. Boundary markers: No specific delimiters or safety instructions are used when interpolating parsed log data into reports. Capability inventory: The skill reads filesystem artifacts, writes analysis files, and executes external detection tools. Sanitization: Log data is extracted and converted to JSON/CSV formats without specific sanitization of the content itself, as is expected for forensic fidelity.

extracting-windows-event-logs-artifacts