The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install several third-party security tools and libraries.
Fetches the CAPE Sandbox repository from GitHub (github.com/kevoreilly/CAPEv2) and runs an installation script (cape2.sh).
Clones the ASD Azul analysis platform from GitHub (github.com/AustralianSignalsDirectorate/azul).
Recommends installing Python packages yara-python and flare-floss via pip.
[COMMAND_EXECUTION]: The workflow relies heavily on executing shell commands to analyze malware samples.
Uses tools like file, strings, rabin2, floss, pecheck, pescan, diec, and sha256sum for static analysis.
Uses curl and wget for submitting samples to remote sandbox APIs.
[PRIVILEGE_ESCALATION]: The installation process for the CAPE Sandbox requires the use of sudo to execute the cape2.sh script, which is a common requirement for setting up virtualization and analysis environments.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from malware samples.
Ingestion points: Malware binaries and scripts (EXE, ELF, APK, PowerShell, VBA) are processed using strings and static analysis tools in SKILL.md.
Boundary markers: None identified; the agent is instructed to directly parse and categorize output from these samples.
Capability inventory: The skill has access to network operations (curl, wget), local file analysis tools, and the ability to author YARA/Sigma rules based on sample content.
Sanitization: No specific sanitization or escaping of the parsed strings is mentioned before they are included in reports or rules, representing a theoretical injection surface common to analysis tools.

malware-analysis