The Agent Skills Directory

[SAFE]: The repository contains documentation, workflows, templates, and scripts for endpoint forensics and triage collection. No malicious patterns or behaviors were identified.
[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.run() to execute standard Windows utilities like wmic, netstat, reg, and schtasks. The commands are structured as safe argument lists without enabling shell mode (shell=True), preventing command injection risks.
[DATA_EXFILTRATION]: Collected data from the system triage process is formatted into structured JSON and printed locally to standard output or written to a designated local path. There are no network transmission routines or external data exfiltration channels.

performing-endpoint-forensics-investigation