The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system binaries and external tools to perform analysis. Examples include scripts/triage.sh executing file, ls, md5sum, readelf, checksec, and nm on target binaries, and scripts/decompile.py orchestrating ghidra, radare2, jadx, ilspycmd, and wasm2wat via subprocess.run calls.\n- [REMOTE_CODE_EXECUTION]: The skill employs dynamic execution patterns, particularly in its interaction with Ghidra. scripts/decompile.py dynamically generates a Python script (ghidra_export.py) at runtime and executes it using Ghidra's headless analyzer. Additionally, references include instructions for generating and executing shared libraries via LD_PRELOAD to bypass security checks.\n- [EXTERNAL_DOWNLOADS]: The documentation provides instructions for downloading and installing various third-party security tools from GitHub and official repositories, such as frida-gadget, jadx, and ilspycmd. It also includes logic to automatically install ilspycmd via the dotnet package manager if it is missing from the host system.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of ingesting and processing untrusted binary data. \n
Ingestion points: Target binary files processed by scripts/triage.sh and scripts/strings-extract.py.\n
Boundary markers: Not explicitly implemented for extracted string data presented to the agent.\n
Capability inventory: Significant capabilities including file system access, network operations, and arbitrary command execution as documented in scripts/decompile.py and scripts/triage.sh.\n
Sanitization: Variable quoting is used in shell scripts, but there is no verification of content extracted from untrusted binaries which drives agent hypotheses.

universal-reverse-engineer