The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py utilizes subprocess.run to execute the Windows reg.exe utility for querying registry keys. The commands are constructed using static key paths defined within the script, and arguments are passed as a list rather than a raw string, effectively mitigating potential command injection vulnerabilities. This functionality is consistent with the skill's stated purpose of registry auditing.
[DATA_EXPOSURE]: The skill accesses sensitive areas of the Windows registry (e.g., Run keys, Winlogon settings, IFEO). While this involves reading sensitive configuration data, it is the primary intended function of a threat-hunting tool. No evidence of data exfiltration (e.g., via network requests or cloud uploads) was found; results are either printed to the console or saved to a local file defined by the user.
[SAFE]: The skill uses Python's standard libraries and does not include or download any third-party dependencies, minimizing supply chain risk. The logic for scanning and analyzing logs is transparent and resides within the provided scripts.

hunting-for-registry-persistence-mechanisms