memory-forensics
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for performing low-level system operations to acquire and analyze memory dumps.
- Evidence: Commands such as dd if=/dev/mem, insmod lime.ko, and vboxmanage debugvm are documented in SKILL.md.
- [PRIVILEGE_ESCALATION]: The skill includes commands that require elevated permissions to interact with hardware and kernel-level structures.
- Evidence: Frequent use of sudo for memory extraction tasks in SKILL.md.
- [EXTERNAL_DOWNLOADS]: The skill references external resources for tool installation and configuration.
- Evidence: pip install volatility3 and links to symbol tables on downloads.volatilityfoundation.org in references/details.md.
- [INDIRECT_PROMPT_INJECTION]: The skill describes workflows where the agent analyzes potentially malicious or untrusted data sources.
- Ingestion points: Memory dumps (memory.raw), malware samples (malware.exe), and YARA rules (malware.yar) mentioned in SKILL.md and references/details.md.
- Boundary markers: None present in the instructions.
- Capability inventory: Tooling includes vol (Volatility 3), strings, floss, grep, pip, and system utilities (dd, insmod) throughout the skill files.
- Sanitization: The instructions do not specify sanitization or validation for the forensic artifacts being processed.
Audit Metadata