The Agent Skills Directory

[SAFE]: The skill performs legitimate threat-hunting activities by scanning Windows startup directories and auditing registry keys for persistence markers.- [COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.run to execute the Windows reg query command. The command is used to audit autostart entries in specific registry paths. The arguments are sourced from a hardcoded list of standard system paths, preventing command injection.- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known Python packages watchdog and pefile. These are used for their intended purpose of filesystem event monitoring and metadata analysis.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local host, such as filenames and registry values. 1. Ingestion points: Local filenames in startup directories and values within the Windows Registry. 2. Boundary markers: Absent; the output is structured JSON. 3. Capability inventory: File metadata reading, file hashing, and registry querying via subprocess. 4. Sanitization: The script performs comparative analysis and risk scoring; it does not execute or evaluate the content of the files or registry values.

hunting-for-startup-folder-persistence