protocol-reverse-engineering

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of network traffic and packet capture files. This creates a vulnerability surface where maliciously crafted network data could attempt to influence the agent's logic or output.
  • Ingestion points: Operations like rdpcap("capture.pcap") and tshark -r capture.pcap in SKILL.md ingest external data into the analysis workflow.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands within the processed packets are provided.
  • Capability inventory: The skill utilizes powerful capabilities including network packet transmission (send()), file writing (tshark -w), and interactive shell commands (wireshark, tcpdump) in SKILL.md.
  • Sanitization: There is no evidence of sanitization or validation of the data extracted from the network packets before it is processed.
  • [COMMAND_EXECUTION]: The skill provides numerous command-line examples for standard network tools like tcpdump, wireshark, and mitmproxy which are used for the primary purpose of protocol reverse engineering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:46 AM