nsm-ids-triage
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is strictly read-only and operates on existing packet capture files on disk. It does not support live sniffing or network writes, minimizing the attack surface.
- [COMMAND_EXECUTION]: The skill utilizes a set of well-defined tools (
nsm_status,nsm_update_rules,nsm_alerts,nsm_analyze) through a specific MCP server (nsm-mcp). These tools are purpose-built for network security monitoring and do not provide arbitrary shell access. - [DATA_EXFILTRATION]: No data exfiltration patterns were identified. The skill focuses on local analysis, and its interactions are confined to the defined MCP toolset.
- [PROMPT_INJECTION]: The instructions provide robust guidance to the agent on how to interpret IDS alerts honestly, specifically preventing the agent from misinterpreting a lack of signatures as a 'clean' network traffic verdict.
Audit Metadata