skills/mukul975/anthropic-cybersecurity-skills/analyzing-network-traffic-of-malware/Gen Agent Trust Hub
analyzing-network-traffic-of-malware
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of multiple system commands to perform its primary function. These include
tshark,capinfos,zeek,suricata, andsha256sum, which are used for packet extraction, protocol analysis, and signature matching. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from malware sandbox network captures (PCAP files), which represents a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: Network packet fields, DNS query names, and HTTP request/response bodies are parsed from PCAP files using
dpktandscapyinscripts/agent.pyand varioustsharkcommands. - Boundary markers: There are no explicit instructions or delimiters used to separate the analyzed malware data from the agent's primary instructions.
- Capability inventory: The skill environment allows for shell command execution and file system operations, providing an exploit path if the agent is manipulated by malicious strings in the parsed data.
- Sanitization: The
agent.pyscript utilizes standard UTF-8 decoding with error replacement (errors="replace") for extracted DNS query names, but no further sanitization of packet content is performed before presentation to the agent context.
Audit Metadata