protocol-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of network traffic and packet capture files. This creates a vulnerability surface where maliciously crafted network data could attempt to influence the agent's logic or output.
- Ingestion points: Operations like
rdpcap("capture.pcap")andtshark -r capture.pcapinSKILL.mdingest external data into the analysis workflow. - Boundary markers: No specific delimiters or instructions to ignore embedded commands within the processed packets are provided.
- Capability inventory: The skill utilizes powerful capabilities including network packet transmission (
send()), file writing (tshark -w), and interactive shell commands (wireshark,tcpdump) inSKILL.md. - Sanitization: There is no evidence of sanitization or validation of the data extracted from the network packets before it is processed.
- [COMMAND_EXECUTION]: The skill provides numerous command-line examples for standard network tools like
tcpdump,wireshark, andmitmproxywhich are used for the primary purpose of protocol reverse engineering.
Audit Metadata