The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes numerous shell and PowerShell scripts for system administration and incident response. This involves using sudo for loading forensic kernel modules like LiME, manipulating firewall rules via iptables, and managing system services using systemctl or sc.exe. Evidence: found in scripts/forensics-collection.sh, REFERENCE.md (Example 5, 6), and templates/incident-response-playbook.md.
[DATA_EXFILTRATION]: The automated forensics script is designed to collect extensive evidence, including highly sensitive files such as /etc/shadow, user SSH keys, and command history files (.bash_history, .zsh_history). While these represent sensitive data exposure, the activity is a standard and necessary component of forensic investigations following a system compromise. Evidence: found in scripts/forensics-collection.sh under collect_user_artifacts.
[EXTERNAL_DOWNLOADS]: The skill references several external APIs for threat intelligence lookups, including VirusTotal, AlienVault OTX, AbuseIPDB, and ANY.RUN. These are well-known security services used for validating Indicators of Compromise (IOCs). Evidence: found in REFERENCE.md (Example 4) and templates/incident-response-playbook.md.
[CREDENTIALS_UNSAFE]: The playbooks and scripts use placeholders and environment variables (e.g., $VT_API_KEY, $OTX_API_KEY, $ANYRUN_API_KEY) for API authentication. No hardcoded secrets or actual credentials were identified. Evidence: found in REFERENCE.md and templates/incident-response-playbook.md.
[REMOTE_CODE_EXECUTION]: The incident response playbooks include commands to fetch payloads for sandboxing and analysis. These operations are intended for use within controlled forensic environments and do not involve execution on the local host. Evidence: found in templates/incident-response-playbook.md under Attachment Analysis.

security-operations