The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads symbol tables and source code from trusted repositories and official domains.
Fetches Windows, Linux, and Mac symbol packs from downloads.volatilityfoundation.org, which is the official resource for the Volatility 3 tool.
References the official Volatility 3 GitHub repository for source installation.
[COMMAND_EXECUTION]: The scripts/agent.py script automates forensic analysis by executing the vol CLI utility using the Python subprocess module.
The commands are constructed using list-based arguments to prevent shell injection vulnerabilities.
The functionality is limited to wrapping the Volatility 3 tool to generate forensic reports.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from memory dumps, creating a potential surface for indirect prompt injection if malicious content is embedded in the RAM being analyzed.
Ingestion points: Processes raw memory dumps through various Volatility plugins (e.g., windows.pslist, windows.netscan) and extracts strings via windows.strings (found in scripts/agent.py and SKILL.md).
Boundary markers: The skill does not employ explicit delimiters or instructions to the agent to ignore embedded commands within the memory dump data.
Capability inventory: The script has the capability to execute shell commands (via Volatility) and write reports to the local file system.
Sanitization: No specific sanitization or filtering of the extracted memory strings is performed before they are included in the generated JSON report.

performing-memory-forensics-with-volatility3