The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides various templates for executing the tcpdump utility to capture raw network traffic on the system. This allows the agent to perform low-level network monitoring and packet recording.
[PRIVILEGE_ESCALATION]: The use of tcpdump for capturing traffic on network interfaces requires elevated privileges, such as root access or specific Linux capabilities (CAP_NET_RAW). Enabling an agent to run these commands grants it significant administrative-level access to the network stack.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process raw, untrusted network traffic, which serves as an attack surface for indirect prompt injection if the agent interprets the captured data.
Ingestion points: Network interface traffic captured via the tcpdump commands in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the captured network packets.
Capability inventory: Shell command execution for the tcpdump utility and the ability to write capture files to the local file system using the -w flag in SKILL.md.
Sanitization: No sanitization, filtering, or validation of the captured network data is performed before it enters the agent's context.

tcpdump