foremost

The skill description and commands are coherent with a legitimate use-case for forensic data recovery using foremost. It emphasizes local file carving from disk images, with optional structured JSON output via wrappers. There are no credential or network access requirements, and file access is proportionate to the task. The footprint appears benign and aligned with the stated purpose of forensic analysis and data recovery, assuming trusted sources for the foremost binary (official package repositories) and wrapper scripts. Overall, the risk posture is low to moderate (dependent on environment and wrapper reliability).