The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external forensic data, including NTFS Master File Table (MFT) records, USN Journal logs, and ShimCache entries parsed into CSV format. Because this data originates from potentially compromised systems, it represents a surface for indirect prompt injection. However, the analysis scripts in SKILL.md and scripts/agent.py treat the input as structured data, performing strict timestamp parsing and comparison logic, which mitigates the risk of the agent misinterpreting malicious data as instructions.
[PRIVILEGE_ESCALATION]: The provided workflow includes instructions for using sudo on Linux to mount disk images and tools like RawCopy.exe or kape.exe on Windows to access protected system files like the $MFT. These are standard and necessary procedures for digital forensic acquisitions and are appropriate for the skill's intended cybersecurity use case.
[COMMAND_EXECUTION]: The skill documentation provides instructional command-line examples for various well-known forensic utilities, such as Eric Zimmerman's MFTECmd, FTK Imager, and the Sleuthkit (icat). These commands are essential for the data extraction and parsing phases of the forensic analysis pipeline.

hunting-for-defense-evasion-via-timestomping