The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several system utilities for network analysis, including lldpcli, arp-scan, and arping. These tools are used to query local network topology and neighbor information.
Evidence: Mentions of lldpcli show neighbors, arp-scan -l, and arping throughout the documentation.
Usage often requires administrative privileges or specific capabilities (e.g., cap_net_raw) to access raw sockets.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing dependencies from official repositories and well-known package managers.
Evidence: Installation commands for apt (Debian/Ubuntu), brew (macOS), and cargo install (Rust crates registry) for tools like lldpd and arp-scan-rs.
[INDIRECT_PROMPT_INJECTION]: The skill processes data received from external network devices via LLDP/CDP frames and ARP responses. This creates a surface for indirect prompt injection where a malicious device on the local network could provide crafted metadata.
Ingestion points: Command output from lldpcli show neighbors -f json and arp-scan -l --json (SKILL.md).
Boundary markers: Not explicitly defined for the interpolation of discovered network data.
Capability inventory: The agent has access to Bash, Write, and Edit tools (SKILL.md frontmatter).
Sanitization: Suggests using jq for structured parsing of JSON output, which mitigates some risks of direct execution but does not fully prevent instruction injection into the agent's context.

layer2-discovery