The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple system commands and network utilities including tshark, tcpdump, dumpcap, editcap, and mergecap to capture and process network data. It also uses system package managers (apt, brew, winget) for installation.
[PRIVILEGE_ESCALATION]: Setup instructions involve using sudo for package installation and system configuration, specifically to allow the wireshark group to capture packets without root. The skill documentation explicitly recommends against running the protocol dissectors themselves as root to minimize security risks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external packet capture (PCAP) files. This presents a vulnerability surface where maliciously crafted network traffic could contain string-based patterns intended to influence the agent's reasoning during analysis.
Ingestion points: PCAP files read via tshark -r <file>.
Boundary markers: None specified for the data output.
Capability inventory: File system read/write, network capture, and command execution.
Sanitization: The skill relies on tshark's standard field extraction and filtering.

wireshark