The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses the subprocess module to call external binaries including tshark and suricata for packet analysis and IDS alert generation.
Evidence includes calls in functions run_tshark, get_pcap_summary, detect_data_exfiltration, detect_ids_alerts, and extract_http_objects.
The implementation uses list-based arguments which mitigates shell injection risks, and the usage is consistent with the skill's primary purpose of network forensics.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of PCAP files.
Ingestion points: The scripts/agent.py script reads PCAP files using scapy.rdpcap and tshark -r.
Boundary markers: None implemented for the processing of raw network traffic.
Capability inventory: The script has the ability to execute system commands via subprocess and write files to the local file system (e.g., in extract_http_objects).
Sanitization: There is no explicit sanitization of packet content before it is processed or summarized, which is typical for forensics tools but represents an attack surface where a malformed packet could target vulnerabilities in the underlying analysis tools.

analyzing-network-traffic-for-incidents