analyzing-network-flow-data-with-netflow
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
netflowpackage from a public registry to support NetFlow and IPFIX record parsing. - [COMMAND_EXECUTION]: The skill utilizes
tcpdumpfor traffic capture and executes a local analysis scriptscripts/agent.pyto process captured flows and generate reports. - [PROMPT_INJECTION]: The skill processes external network data, creating a surface for indirect prompt injection where malicious instructions could be embedded in flow metadata.
- Ingestion points: Data enters the system context via
captured_flows.jsonwhen parsed by the agent script. - Boundary markers: The instructions lack explicit delimiters or safety warnings to ignore instructions embedded in the analyzed data.
- Capability inventory: The agent has the capability to execute shell commands and write files based on the analysis of these records.
- Sanitization: No explicit sanitization or validation of the flow record content is described beyond standard library parsing.
Audit Metadata