The Agent Skills Directory

[COMMAND_EXECUTION]: The Python utility scripts/agent.py includes a function run_zeek_on_pcap that executes the zeek system binary using subprocess.run. This is a legitimate functional requirement for processing packet capture files into logs. The implementation follows security best practices by using a list-based argument structure and avoiding the shell execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes network traffic data (such as DNS queries and HTTP headers) which are inherently untrusted external inputs. This represents a potential surface for indirect prompt injection where an attacker could embed instructions in network traffic to influence the agent's analysis. The provided script mitigates this risk by focusing on structured metadata extraction and statistical aggregation rather than open-ended natural language interpretation of log content.

performing-network-traffic-analysis-with-zeek