The Agent Skills Directory

[COMMAND_EXECUTION]: The automation script scripts/agent.py utilizes subprocess.run with shell=True to execute system-level commands like tshark and suricata.
The commands are constructed using f-string interpolation with variables such as pcap_path and display_filter across several functions: run_tshark, get_pcap_summary, detect_data_exfiltration, detect_ids_alerts, and extract_http_objects.
Since pcap_path is sourced directly from user-provided command-line arguments (sys.argv[1]), an attacker could provide a filename containing shell metacharacters (e.g., ; rm -rf /) to execute arbitrary commands with the privileges of the agent.
The display_filter parameter in run_tshark is also interpolated into a shell string, which could be exploited if the agent accepts arbitrary filter strings from untrusted sources.
[DATA_EXFILTRATION]: The extract_http_objects function in scripts/agent.py automatically extracts files from PCAP data and saves them to a local directory (/tmp/http_objects). While intended for forensics, this mechanism could be used to move sensitive data from within network captures to more accessible or observable locations on the host system.

analyzing-network-traffic-for-incidents