The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous commands for memory acquisition and analysis that require high privileges.
Evidence: Instructions include sudo insmod lime.ko, sudo dd if=/dev/mem, and sudo cp /proc/kcore for Linux memory acquisition, as well as winpmem_mini_x64.exe for Windows.
[EXTERNAL_DOWNLOADS]: The skill references standard tool installation and configuration from external sources.
Evidence: Instructions include pip install volatility3 and downloading symbol tables from https://downloads.volatilityfoundation.org/volatility3/symbols/, which is an industry-standard resource for this task.
[SAFE]: The skill acts as a technical reference guide for legitimate forensic activities. The methods described, including process analysis, network connection scanning, and registry artifact extraction, are standard incident response practices. No attempts at credential exfiltration or persistence were found.

memory-forensics