The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses aggressive, imperative language to override and constrain the agent's default behavior. Phrases such as "IAT 修复铁律" (IAT Repair Iron Law), "MUST 顺序" (MUST Sequence), and "禁止冒充完成" (Forbidden to fake completion) are used to prevent the agent from summarizing, skipping steps, or prematurely declaring a sample safe. While these are defensive in context, they represent an attempt to bypass standard agent operational flexibility.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted and potentially malicious data from binary samples and scripts. Tools used (e.g., strings, rabin2, floss) output raw content directly into the agent's context. A malicious sample could contain specially crafted strings designed to hijack the agent's instructions (e.g., encoded acrostics or direct command injections embedded in binary metadata).
Ingestion points: Processes untrusted binary samples and scripts via CLI tools in SKILL.md and automated Python logic in references/sandbox-orchestration.md.
Boundary markers: The skill lacks explicit boundary markers or "ignore embedded instructions" warnings when processing tool output.
Capability inventory: Extensive shell command execution, filesystem read/write, and network operations to external sandbox APIs.
Sanitization: No evidence of sanitization or filtering for the output of strings/decompilation tools before they are processed by the LLM.
[COMMAND_EXECUTION]: The workflow relies heavily on executing a wide array of powerful CLI tools (Ghidra, radare2, x64dbg, etc.) on local files. This capability, while necessary for the task, provides a high-impact surface if the agent is misled by malicious input.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to download and install security tools from external sources, including kevoreilly/CAPEv2 and the AustralianSignalsDirectorate/azul repository. These are recognized, well-known entities in the security community, and the references are documented neutrally as part of the intended toolchain setup.

malware-analysis