The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script uses subprocess.run to execute external forensic tools such as log2timeline.py and psort.py. This behavior is the intended purpose of the script, serving as a wrapper to automate forensic workflows.
[PRIVILEGE_ESCALATION]: Documentation in SKILL.md includes commands using sudo to install the Plaso toolset and manage Docker containers. These are standard system administration tasks required for setting up a forensic environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingest and processes external forensic evidence from disk images and logs. There is a theoretical surface for indirect prompt injection if an attacker embeds malicious instructions within the logs being processed, which is a common risk factor in digital forensics analysis.
Ingestion points: Forensic images (dd, E01, VMDK) and exported CSV/JSONL files in scripts/agent.py and SKILL.md.
Boundary markers: None specific; uses standard CSV parsing.
Capability inventory: File system writes (creating storage files/reports), subprocess execution (running forensic tools).
Sanitization: Standard CSV DictReader used; no specific NL-level sanitization for ingested log content.

performing-timeline-reconstruction-with-plaso