The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py utilizes the subprocess.run function to execute the system arp -a command to retrieve the current ARP table. While the command arguments are hardcoded, reducing the risk of injection, the skill possesses the capability to spawn external system processes.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external network data, creating a potential surface for indirect injection attacks through maliciously crafted packets or log entries.\n
Ingestion points: Data enters the system via the analyze_pcap_arp function (PCAP files) and the check_arpwatch_log function (/var/lib/arpwatch/arp.dat log file) in scripts/agent.py.\n
Boundary markers: There are no explicit delimiters or boundary markers used to isolate untrusted data during its processing or analysis.\n
Capability inventory: The script performs system command execution, local file reads, and generates output report files.\n
Sanitization: The script extracts protocol-specific fields but does not perform comprehensive sanitization or escaping of the network-derived data before it is displayed to the user or saved in a JSON report.

detecting-arp-poisoning-in-network-traffic