The Agent Skills Directory

[SAFE]: The skill uses standard operating system package managers (apt, dnf, pacman, brew, choco) to install well-known and trusted security utilities like Wireshark and OpenSSL.
[SAFE]: Command-line examples follow best practices for network traffic analysis, such as JA3/JA4 fingerprinting and certificate parsing, without exhibiting malicious patterns or credential exfiltration.
[SAFE]: The use of environment variables like SSLKEYLOGFILE is a standard and documented method for authorized TLS decryption in research and debugging environments.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing untrusted external data via network capture files (.pcap).
Ingestion points: Untrusted data enters the context when the agent reads network capture files using tshark -r (SKILL.md).
Boundary markers: None (typical for binary capture file analysis).
Capability inventory: The skill utilizes tshark, openssl, xxd, and shell utilities for data transformation and analysis.
Sanitization: Relies on the robust parsing logic of established security tools; however, the data is treated as forensic evidence rather than instructions for the agent.

re-tls