The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external log data from Suricata and Zeek, which includes information derived from potentially hostile network traffic. This creates a surface where an adversary could craft network payloads that, when parsed into IDS logs and subsequently analyzed by the skill, might contain deceptive information intended to influence the agent or analyst.
Ingestion points: Log parsing functions in scripts/agent.py and SKILL.md read eve.json and conn.log files.
Boundary markers: Absent; the resulting analysis reports do not employ delimiters to distinguish between system instructions and ingested log content.
Capability inventory: File reading, data aggregation, and report generation.
Sanitization: Standard log parsing is performed using JSON loading and regex, without specific sanitization against instruction injection within the log fields.
[PRIVILEGE_ESCALATION]: The skill's workflow includes manual instructions for the user to deploy rules and modify configurations in system-protected directories such as /etc/suricata/ and /var/lib/suricata/. These actions require administrative permissions but are standard procedures for the installation and tuning of network security monitoring tools and do not involve automated privilege escalation exploits.

detecting-network-scanning-with-ids-signatures