The Agent Skills Directory

[SAFE]: The skill implementation follows standard security analysis practices for threat hunting and forensic investigation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external network traffic data which represents a potential attack surface, although the risk is minimized by the skill's limited capabilities.
Ingestion points: The scripts/agent.py script reads external packet capture (PCAP) files using the scapy library.
Boundary markers: The script does not utilize specific delimiters or instructions to ignore instructions that might be embedded within the DNS traffic being analyzed.
Capability inventory: The script is limited to reading local files and writing a JSON report; it contains no subprocess calls, network exfiltration logic, or dynamic execution (eval/exec).
Sanitization: DNS query names are decoded from raw packet bytes using standard methods without additional filtering of the content.

performing-dns-tunneling-detection