The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line examples for memory acquisition and analysis, including the use of dd, insmod, cp, vboxmanage, vol, strings, grep, and floss. These commands are standard for the forensic domain and are used for legitimate investigative purposes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process memory dumps and forensic artifacts, which are untrusted external data sources. This creates a surface for indirect prompt injection if the content extracted from memory (such as strings or process environment variables) contains malicious instructions intended for the agent.
Ingestion points: Memory dump files (e.g., memory.raw, memory.lime, vm.vmem) and process dumps.
Boundary markers: No explicit delimiters are specified to distinguish between forensic data and instructions, though the instructions imply a data-processing context.
Capability inventory: The agent can execute forensics tools, perform file system operations, and extract strings from binary data.
Sanitization: No specific sanitization or escaping of extracted strings is mentioned.
[EXTERNAL_DOWNLOADS]: The skill suggests downloading symbol tables from the official Volatility Foundation website (downloads.volatilityfoundation.org). This is a well-known and trusted source for forensics-related configuration data.
[PRIVILEGE_ESCALATION]: Several instructions involve the use of sudo (e.g., sudo insmod lime.ko, sudo dd if=/dev/mem) to acquire system memory. These elevated permissions are standard requirements for live memory acquisition on Linux and macOS systems.
[REMOTE_CODE_EXECUTION]: Includes standard package installation instructions for volatility3 via pip. This is a well-known, legitimate library for memory forensics.

memory-forensics