The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides commands that require elevated privileges, specifically utilizing sudo apt install networkminer for the installation of software packages.
[COMMAND_EXECUTION]: The skill heavily depends on executing numerous system and forensic tools through the command line (e.g., tshark, binwalk, foremost, hashcat, editcap, mergecap) to process and reconstruct network data.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install external software packages from package repositories.
[INDIRECT_PROMPT_INJECTION]: The skill is intended to ingest and analyze potentially malicious data from external PCAP files, which serves as a significant attack surface.
Ingestion points: The skill reads external capture files (.pcap, .pcapng) from the filesystem for processing.
Boundary markers: There are no boundary markers or specific instructions to the agent to treat the contents of these network captures as untrusted data or to ignore embedded instructions.
Capability inventory: The agent is granted extensive shell command execution, file system read/write access for file carving, and the ability to process complex protocol data.
Sanitization: No sanitization or validation of data extracted from the captures (such as HTTP headers, DNS query names, or SMTP payloads) is performed before the information is processed or displayed.

traffic-analysis-pcap