memory-forensics-volatility
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides documentation and shell command templates for using forensic tools such as Volatility, LiME, and AVML. These commands are intended for analyzing memory dumps in a controlled forensic environment and are consistent with the skill's primary purpose.
- [INDIRECT_PROMPT_INJECTION]: As a forensic tool, the skill is designed to ingest and process untrusted binary data from memory dumps, which presents a theoretical surface for indirect prompt injection.
- Ingestion points: External memory artifacts (e.g.,
mem.raw,mem.lime,.vmemfiles) analyzed through Volatility plugins. - Boundary markers: Absent; the skill provides raw command templates without defining specific output delimiters for the agent to distinguish between tool output and instructions.
- Capability inventory: The skill involves command execution (
bash), file reading/writing for extraction (dumpfiles), and system metadata analysis. - Sanitization: Absent; the skill relies on the forensic investigator or the agent's internal logic to parse tool output safely. In the context of a specialized forensics playbook, this is an inherent and accepted risk factor.
Audit Metadata