analyzing-command-and-control-communication
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using heredocs (
cat << 'EOF') to create configuration files and IDS rules on the local file system. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of several third-party Python libraries, including
scapy,dpkt, andcobalt-strike-parser, to perform packet analysis and configuration extraction. - [PROMPT_INJECTION]: The skill processes untrusted network traffic data (PCAP files) and displays portions of the payload, creating a surface for indirect prompt injection.
- Ingestion points: PCAP file contents are read and parsed via the
agent.pyscript. - Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the analyzed packet data.
- Capability inventory: The agent possesses the capability to write files to the local system and make network requests to external threat intelligence APIs (Shodan and VirusTotal).
- Sanitization: While the script uses basic decoding with error replacement, there is no specific sanitization or filtering to prevent the agent from interpreting instructions embedded within malicious network payloads.
Audit Metadata