The Agent Skills Directory

[COMMAND_EXECUTION]: The Python agent script (scripts/agent.py) utilizes subprocess.run to execute commands for Zeek version retrieval, status reporting, and PCAP analysis. Evidence shows the script avoids using the shell (shell=True) by passing arguments as a list, which mitigates common command injection vectors.
[PRIVILEGE_ESCALATION]: The setup instructions in SKILL.md include commands prefixed with sudo for package management, directory permissions, and service deployment. These elevated permissions are justified by the tool's requirement to bind to network interfaces for passive capture and manage system-level logging.
[PERSISTENCE]: The workflow involves creating a cron job (/etc/cron.d/zeek-logrotate) that executes zeekctl cron daily. This is a standard system administration task to ensure long-term operational health of the monitoring system by managing log volumes.
[EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for Zeek as a source for compiling the tool. This is a well-known and trusted open-source project within the cybersecurity community, and its inclusion follows best practices for obtaining the latest version of the software.

detecting-network-anomalies-with-zeek