The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script utilizes the subprocess module to execute system commands such as systemctl, suricata, and suricatasc. These calls are used to monitor the service status and retrieve performance counters. The commands are hardcoded and do not incorporate user-supplied arguments.
[EXTERNAL_DOWNLOADS]: Documentation in SKILL.md instructs the installation of Suricata via an official PPA (ppa:oisf/suricata-stable) and the management of rules via suricata-update, which fetches signatures from the Emerging Threats ruleset. These are standard and legitimate sources for network security software.
[INDIRECT_PROMPT_INJECTION]: The scripts/agent.py script processes data from Suricata's EVE JSON logs (eve.json). While this data originates from network traffic (untrusted sources), the script only performs statistical analysis and reporting.
Ingestion points: Reads eve.json log entries in scripts/agent.py.
Boundary markers: The script uses structured JSON parsing (json.loads) and filters specifically for alert event types.
Capability inventory: File read/write operations for logs and reports; subprocess.run for service status monitoring in scripts/agent.py.
Sanitization: Implements basic JSON validation and error handling during log ingestion; however, it does not explicitly sanitize log fields like signature names before including them in the generated report JSON.
[PRIVILEGE_ESCALATION]: The skill guides the user to perform administrative tasks using sudo, such as installing packages, modifying /etc/suricata/suricata.yaml, and configuring iptables for traffic interception. These elevated privileges are necessary for the installation and operation of a network-layer security tool.

implementing-network-intrusion-prevention-with-suricata