The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/collect-evidence.sh executes multiple system diagnostic tools including ps, ss, ip, iptables, and uname to capture the state of the system during a security incident. These commands are standard for forensic evidence gathering.
[COMMAND_EXECUTION]: The references/incident-playbook.md and references/ioc-hunting.md files provide specific command-line instructions for incident containment and eradication, such as modifying firewall rules with iptables, terminating processes with kill, and managing user accounts with usermod.
[DATA_EXFILTRATION]: The scripts/collect-evidence.sh script accesses sensitive system files including /etc/passwd, /etc/group, and various authentication logs in /var/log/. This activity is intended for local evidence preservation, with the collected data being stored in a temporary archive in the /tmp directory without any network transmission.

incident-response