The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides automated and manual commands for system utilities such as wevtutil to query Windows Event Logs and vol3 for deep memory forensics.
[EXTERNAL_DOWNLOADS]: Documents the use of well-known industry libraries like pefile and capstone, as well as the Volatility 3 framework, for analyzing binary data and process memory.
[DYNAMIC_EXECUTION]: Includes Python code snippets that use the subprocess module to interact with system tools and perform runtime disassembly of shellcode using standard forensics libraries.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from memory dumps and system events, which represents a potential attack surface.
Ingestion points: Memory dump files and Sysmon XML logs processed via wevtutil in SKILL.md.
Boundary markers: None; the agent is instructed to directly parse and analyze external artifacts.
Capability inventory: Shell command execution via subprocess, file system read access for memory dumps, and arbitrary Python execution for binary analysis.
Sanitization: No explicit validation or escaping of strings extracted from process memory or log data is performed before printing or processing.

detecting-process-injection-techniques