The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Downloads Snort 3, the DAQ library, and PulledPork 3 from established GitHub repositories (snort3, shirkdog). Official rule updates are retrieved from the snort.org domain.
[COMMAND_EXECUTION]: The scripts/agent.py management script executes the snort binary using subprocess.run to perform configuration validation and network traffic analysis.
[PERSISTENCE]: The skill establishes systemd services (snort.service, snort-iface.service) to ensure monitoring and interface configurations persist across system reboots.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted network metadata through Snort logs and packet captures. 1. Ingestion points: The scripts/agent.py script reads alert_fast.txt, alert_json.txt, and processes PCAP files via the Snort binary. 2. Boundary markers: None identified in the log parsing or PCAP processing logic. 3. Capability inventory: The management script can read/write files and execute the Snort binary with arbitrary file paths via subprocess.run. 4. Sanitization: Log extraction relies on basic regex and JSON decoding without explicit sanitization of the extracted message content.

configuring-snort-ids-for-intrusion-detection