The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py utilizes the subprocess module to execute a variety of PowerShell cmdlets and registry queries. These operations are dedicated to auditing system security controls (e.g., Secure Boot, VBS, AppLocker). The commands are implemented as static lists without incorporating external user input, effectively mitigating the risk of command injection.
[DATA_EXPOSURE]: The agent audits sensitive system information, including local Administrators group members and a registry-based inventory of installed software. This data is printed to the local console in JSON format as part of its intended audit functionality. The script does not contain any network exfiltration logic or unauthorized data storage mechanisms.

implementing-privileged-access-workstation