The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions utilize a wide range of standard security utilities for analyzing binary and document structures, including sha256sum, capa, floss, binwalk, oletools, and Volatility. These are executed within the context of malware triage.
[EXTERNAL_DOWNLOADS]: The skill references an external utility service, https://defuddle.md/, for converting web-based reports and advisories into markdown to reduce token consumption. The instructions include explicit warnings against routing adversary-controlled infrastructure through this third-party service to prevent attribution leakage.
[PROMPT_INJECTION]: The skill is designed to ingest and process highly untrusted data (malware samples, obfuscated scripts, and external URLs), creating a surface for indirect prompt injection.
Ingestion points: Malware specimens, office documents, scripts, and external advisories via defuddle.md (SKILL.md).
Boundary markers: The skill contains a mandatory 'Containment' section requiring execution in disposable VMs with isolated networking and no host sharing to mitigate the risk of malicious payloads influencing the system.
Capability inventory: The skill uses bash for tool execution, python for data parsing, and curl for network operations (SKILL.md).
Sanitization: The skill emphasizes physical and logical isolation (air-gapping, snapshots) as the primary security control when dealing with untrusted content.

analyzing-malware