routeros-sniffer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted network data from RouterOS using tools like
tsharkand Wireshark. This creates an attack surface where malicious network packets could contain instructions intended to influence the agent's behavior during protocol analysis. - Ingestion points: Network interfaces monitored via
tshark -i anyand/tool/snifferpacket streams. - Boundary markers: No specific delimiters or safety instructions are provided to sanitize or isolate the packet content from the agent's prompt context.
- Capability inventory: The skill utilizes
curlfor REST API interactions,tsharkfor live capture, andqemu-system-x86_64for environment emulation. - Sanitization: No packet sanitization or filtering logic is suggested beyond protocol-level filters.
- [PRIVILEGE_ESCALATION]: The host-side setup instructions require administrative privileges to install tools and modify security policies.
- Evidence: The file
references/tzsp-receivers.mdincludes commands forsudo apt install tshark,sudo ufw allow 37008/udp, andsudo iptables -A INPUT -p udp --dport 37008 -j ACCEPT. - [COMMAND_EXECUTION]: The skill provides numerous CLI command patterns for the agent to execute on both the host and the router.
- Evidence: Commands for
qemu-system-x86_64VM management,curlfor remote administration, andtshark/tcpdumpfor network monitoring are provided across both files.
Audit Metadata