The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from industrial environments, which presents a surface for indirect prompt injection attacks if that data contains malicious instructions targeting the LLM.
Ingestion points: The process_pcap function in SKILL.md (via scapy) and the fetch_current_values function in SKILL.md (ingesting JSON from a historian API).
Boundary markers: None. The instructions do not include delimiters or warnings to ignore instructions potentially embedded within the ingested PCAP or historian data.
Capability inventory: The skill scripts can perform network port scanning, interact with Modbus and S7comm protocols, and query SIEM APIs. These capabilities could be abused if the agent is misled by injected data.
Sanitization: There is no evidence of sanitization or validation of the input strings parsed from network traffic or historian JSON before they are processed.
[COMMAND_EXECUTION]: The scripts/agent.py and SKILL.md scripts perform active network operations. This includes scanning for industrial control ports (e.g., Modbus 502, S7comm 102) and attempting to establish connections with PLCs. While these are documented features of the skill, they represent active scanning capabilities that should be used with caution in sensitive industrial environments.
[METADATA_POISONING]: An inconsistency exists between the skill's frontmatter, which identifies the author as 'mahipal', and the license file which attributes copyright to 'mukul975'. While not inherently malicious, this reflects poor metadata management.
[OBFUSCATION]: A hex-encoded byte array (cotp_cr) is found in scripts/agent.py. Analysis confirms this is a standard 22-byte ISO-TSAP/COTP Connection Request packet used for Siemens S7comm protocol identification. Its presence is required for the skill's stated purpose of auditing PLC accessibility and is not a malicious obfuscation attempt.

detecting-attacks-on-scada-systems