memory-forensics-volatility
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructional content for memory forensics analysis and does not contain any malicious code or exfiltration patterns.
- [COMMAND_EXECUTION]: Includes templates for shell commands to execute Volatility tools, memory acquisition utilities (like
dd,winpmem,DumpIt), and kernel modules (insmod lime.ko). These commands are standard for forensic investigations and are intended for use on system memory dumps. - [CREDENTIALS_UNSAFE]: Documents the use of forensic plugins such as
hashdump,lsadump, andmimikatzfor the purpose of analyzing memory images for credential artifacts. No hardcoded credentials or unauthorized exfiltration mechanisms were found. - [EXTERNAL_DOWNLOADS]: References official installation methods for the Volatility framework via standard package managers (
pip2,pip3). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data in the form of memory dumps. Ingestion points: Memory image files processed via the
-fflag in Volatility commands across SKILL.md and VOLATILITY_CHEATSHEET.md. Boundary markers: None. Capability inventory: The skill utilizes command-line forensic tools for file reading, process analysis, and system inspection. Sanitization: None provided within the instruction set.
Audit Metadata