The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill contains Python and Shell scripts that execute external forensic binaries (e.g., binwalk, tshark, exiftool) using subprocess.run. The use of argument lists instead of shell strings prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS] (SAFE): The documentation recommends installing standard tools from official package managers (Apt, PyPI). No untrusted or unknown external sources are referenced.
[DATA_EXFILTRATION] (SAFE): All network-related functions are for local PCAP file analysis. No scripts attempt to transmit local data to external domains.
[PROMPT_INJECTION] (LOW): There is a theoretical surface for Indirect Prompt Injection because the skill processes untrusted binary data (e.g., via strings or PCAP extraction) which could contain text instructions designed to influence the LLM. However, this is a property of the data being analyzed rather than a malicious intent of the skill itself.
Ingestion points: File paths passed to extraction scripts.
Boundary markers: Absent; the tool outputs raw data to the agent context.
Capability inventory: Subprocess execution of local forensic tools.
Sanitization: None; the tool is intended to show raw findings for analysis.

forensics-tools