The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implementation and instructions promote passing sensitive passwords as command-line arguments.
Evidence: The example command in SKILL.md includes --password secret.
Evidence: scripts/agent.py uses argparse to accept a --password flag, which is then passed to HTTPDigestAuth.
Risk: Credentials passed via command-line arguments are visible to other users on the system via the process list (e.g., ps command) and are often recorded in shell history files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from network traffic without sanitization, creating a potential injection vector.
Ingestion points: scripts/agent.py fetches raw session data, TLS certificate issuer strings, and DNS query information from the Arkime API.
Boundary markers: Findings are written to a JSON report without delimiters or instructions for the agent to ignore embedded instructions.
Capability inventory: The agent can execute scripts, write files, and perform network requests.
Sanitization: No sanitization or validation is performed on strings retrieved from the API (e.g., issuerCN) before they are placed in the output report.
Risk: An attacker controlling network traffic observed by Arkime could embed malicious instructions in TLS fields or DNS queries to influence the agent's behavior during analysis.
[COMMAND_EXECUTION]: The skill requires the agent to execute a Python script that performs network communication and local file writes.
Evidence: The instructions in SKILL.md direct the user to run python scripts/agent.py with various parameters.
[METADATA_POISONING]: The skill contains inconsistent and potentially misleading metadata.
Evidence: SKILL.md lists the author as maipal, while the LICENSE file and system context identify the author as mukul975.
Evidence: The description in SKILL.md claims the tool flags 'known-bad TLS certificate issuers,' but the implementation in scripts/agent.py only checks for self-signed or expired certificates.

implementing-network-traffic-analysis-with-arkime