The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the volatility command-line utility via subprocess.run. This presents a potential command injection risk if the agent does not properly sanitize or validate memory dump file paths provided by the user.
[PROMPT_INJECTION]: The skill creates an Indirect Prompt Injection surface by analyzing untrusted memory dumps. Malicious strings embedded within a dump (such as process names, command histories, or environment variables) could potentially influence the AI agent's subsequent reasoning or actions.
Ingestion points: Binary memory dump files (e.g., memory.dmp, infected.dmp) processed by the Volatility tool.
Boundary markers: No delimiters or safety instructions are defined to separate forensic data from the model's system instructions.
Capability inventory: The skill utilizes subprocess.run to call external binaries and reads from the local file system.
Sanitization: There is no implemented sanitization or filtering for the content extracted from the memory dumps before it is processed by the AI.

memory-forensics