The Agent Skills Directory

[COMMAND_EXECUTION]: The secondary script scripts/agent.py facilitates network diagnostics by executing standard system tools like tshark and nmap via subprocess calls.
Evidence: The script correctly uses argument lists with subprocess.run rather than shell strings, which prevents shell injection vulnerabilities even when processing user-supplied interface or target names.
[EXTERNAL_DOWNLOADS]: The primary orchestrator in SKILL.md relies on the requests library to communicate with a Tenable OT Security instance.
Evidence: This is a standard dependency for API interaction and is explicitly noted as a prerequisite for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from industrial API endpoints and network traffic captures.
Evidence: While the ingestion of external data (such as asset names or vulnerability descriptions) constitutes a theoretical injection surface, the skill implements safe parsing of XML/JSON and contains no exploitable capabilities that would allow ingested data to compromise the host or agent.
[SAFE]: The skill demonstrates best practices for high-availability industrial environments.
Evidence: It enforces 'OT-safe' scan profiles, including T0/T1 timing levels, 500ms rate-limiting between network probes, and explicit blacklisting of high-risk industrial protocols (DNP3, IEC 60870-5-104) that can cause controller failure during active scanning.

performing-ot-vulnerability-scanning-safely