The Agent Skills Directory

[SAFE]: The skill provides standard operating procedures for memory acquisition and analysis using established forensic tools. The instructions in SKILL.md are aligned with digital forensics and incident response (DFIR) best practices.
[COMMAND_EXECUTION]: The scripts/agent.py file uses the subprocess module in the run_volatility function (line 15) to execute Volatility 3 plugins (vol -f <memory_file> <plugin>). This is the core functionality intended for automating the analysis of memory dumps.
[PROMPT_INJECTION]: The scripts/agent.py script possesses an indirect prompt injection surface as it processes output from external forensic tools that parse untrusted memory dumps. 1. Ingestion points: run_volatility (line 30) reads stdout. 2. Boundary markers: Absent. 3. Capability inventory: Command execution via subprocess.run (line 15). 4. Sanitization: Absent; the script performs simple string splitting on the results.

conducting-memory-forensics-with-volatility