The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/agent.py to interact with system forensic utilities including mount, sbverify, and yara. These calls are implemented using list-based arguments without shell=True, which is a security best practice that prevents shell injection. This functionality is essential for the skill's stated purpose of partition and binary analysis.
[EXTERNAL_DOWNLOADS]: The documentation and scripts reference official security research and forensic tools from well-known sources, such as UEFITool from the LongSoft GitHub repository, as well as official Debian/Ubuntu repositories and the Python Package Index (PyPI). These references are documented neutrally as they originate from trusted technology providers and established security firms.
[DATA_EXFILTRATION]: No network exfiltration or credential harvesting patterns were detected. The Python script and the provided command-line instructions operate exclusively on the local filesystem and the isolated mount point of the EFI partition.
[SAFE]: The skill does not contain any evidence of prompt injection, obfuscation, or persistence mechanisms. Its requirement for administrative privileges is appropriate for its intended forensic use case of accessing hardware partitions.

hunting-bootkits-in-efi-system-partition