The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download a pre-built binary for the 'NetWatch' tool from an unverified third-party GitHub repository (github.com/matthart1983/netwatch) rather than an official or trusted vendor.
[REMOTE_CODE_EXECUTION]: Instructions are provided to download, install, and execute the 'NetWatch' binary with root privileges using 'sudo'. This allows the execution of unverified code with full system access.
[COMMAND_EXECUTION]: The skill relies on numerous high-privilege commands to manage network sensors, including 'sudo', 'Set-NetIPInterface -Forwarding Enabled', and scripts that modify persistent system configurations (e.g., 'bridge-setup.sh' and 'win-l3-gateway.ps1').
[DATA_EXFILTRATION]: The skill guides the user in using the 'SSLKEYLOGFILE' environment variable to capture and decrypt TLS traffic. While intended for troubleshooting, this capability allows the exposure of sensitive data transmitted over encrypted connections.
[PROMPT_INJECTION]: The skill's workflow involves processing untrusted network data (packet captures, DNS queries, and connection logs) which can be fed into an LLM for analysis (referenced as 'Insights' in the tool documentation).
Ingestion points: Network packet data and traffic logs processed in 'scenarios/security-ids.md' and via 'netwatch'.
Boundary markers: None identified; untrusted data is processed directly.
Capability inventory: Root-level command execution (via 'sudo'), administrative PowerShell functions, and the ability to modify network routing and firewall settings.
Sanitization: No sanitization or validation of the captured network content is performed before analysis.

netops