The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the NetworkMiner analysis tool from netresec.com and installs standard forensic utilities such as Wireshark and tshark through the system package manager.
[COMMAND_EXECUTION]: Utilizes shell commands for tool installation, environment setup, and packet analysis workflows. This includes the use of sudo for managing system dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted PCAP/PCAPNG files which may contain malicious payloads or metadata. 1. Ingestion points: Network traffic and file objects are ingested via pyshark in scripts/agent.py and through various tshark commands in SKILL.md. 2. Boundary markers: No specific delimiters or safety instructions are provided to the agent to treat capture data as untrusted. 3. Capability inventory: The skill maintains capabilities for shell execution (via tshark, curl, and find) and local file system writes. 4. Sanitization: The workflow lacks explicit sanitization when handling filenames or protocol fields extracted from network objects before passing them to subsequent shell commands.

performing-network-forensics-with-wireshark