analysis-tshark
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires administrative privileges (sudo) to perform live network interface monitoring and raw packet capture, which is a standard operational requirement for TShark.
- [EXTERNAL_DOWNLOADS]: The CI/CD configuration template (
assets/ci-config-template.yml) downloads several security tools including Semgrep, Safety, and Checkov from official package registries, and fetches a configuration script from Aqua Security's public GitHub repository. - [REMOTE_CODE_EXECUTION]: The infrastructure scanning job in the CI template uses a pattern to pipe a remote shell script from Aqua Security's official repository directly into the bash interpreter for tool installation.
- [DATA_EXFILTRATION]: The skill documents procedures for identifying and extracting sensitive data, including HTTP Basic Authentication, FTP credentials, and NTLM hashes, from network traffic as part of forensic and security investigations.
Audit Metadata