The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of sudo for administrative tasks such as acquiring disk images (ewfacquire, dd), managing loopback devices and logical volumes (losetup, vgchange), and mounting encrypted or specialized file systems (mount, cryptsetup, dislocker, apfs-fuse). These operations are inherent to the process of digital forensics on raw storage media.
[EXTERNAL_DOWNLOADS]: References industry-standard digital forensics tools and repositories, including The Sleuth Kit (sleuthkit.org), Google's Plaso project (plaso.readthedocs.io), and bulk_extractor. These are well-known, reputable sources within the security and forensics community.
[DATA_EXPOSURE]: The skill is designed to handle highly sensitive forensic evidence. It incorporates security best practices by insisting on the use of hash verification (sha256sum, ewfverify) at every step and employing restrictive mount options (ro, noexec, norecover, noload) to ensure the integrity of the evidence and prevent accidental execution of recovered files.
[PROMPT_INJECTION]: The skill processes untrusted data in the form of disk images. It correctly manages this risk by using specialized forensic tools (e.g., fls, icat, log2timeline) that interpret raw data rather than executing it, and by advising the examiner to work within a controlled environment.

analyzing-disk-images