skills/mukul975/anthropic-cybersecurity-skills/configuring-suricata-for-network-monitoring/Gen Agent Trust Hub
configuring-suricata-for-network-monitoring
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download Suricata source code from the official OISF GitHub repository and uses the suricata-update utility to fetch rulesets from established threat intelligence sources like Emerging Threats.
- [COMMAND_EXECUTION]: Administrative privileges via sudo are used for essential system-level tasks, including software installation, configuring network interface promiscuity and offloading features (GRO, LRO, etc.), and managing systemd services.
- [COMMAND_EXECUTION]: The helper script in scripts/agent.py uses subprocess calls to execute the Suricata binary for configuration validation, status checks, and rule updates.
- [INDIRECT_PROMPT_INJECTION]: The agent script processes network metadata from logs to provide traffic analysis and statistics. 1. Ingestion points: The scripts/agent.py script reads from the default Suricata EVE JSON log file. 2. Boundary markers: None identified; the script relies on structured JSON formatting. 3. Capability inventory: The script has the capability to execute Suricata management commands and rule update utilities. 4. Sanitization: Log data is parsed using standard JSON libraries and events are filtered based on known event types before processing.
Audit Metadata