nsm-session-pivot
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and workflows focus on legitimate forensic activities including session reconstruction and IDS alert triage. The content contains no evidence of prompt injection, data exfiltration, or malicious obfuscation.- [COMMAND_EXECUTION]: The skill utilizes an MCP server and specialized tools such as
nsm_analyzeandnsm_sessionsto process local packet captures. These operations are strictly scoped to forensic metadata extraction and connection tracking, representing the intended functionality.- [DATA_EXFILTRATION]: The skill operates on local packet capture files and provides no mechanisms for network communication or data exfiltration. All data processing is described as read-only forensic analysis.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for ingesting untrusted data through the analysis of external packet captures. - Ingestion points: Packet capture files (.pcap/.pcapng) processed via the
nsm-mcpserver tools. - Boundary markers: None explicitly defined in the instructions; the skill relies on the Zeek engine's internal parsers to delimit protocol fields.
- Capability inventory: Metadata extraction, session listing, and protocol log retrieval; no capabilities for file-writing, network transmission, or arbitrary code execution are provided.
- Sanitization: Relies on the standard Zeek 8.2.1 protocol parsers to interpret and sanitize packet data before presenting it to the agent.
Audit Metadata