wireshark

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides various bash commands for running Wireshark and Tshark to capture and filter network traffic on local interfaces. These commands involve reading from and writing to packet capture files (pcap) on the local filesystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the analysis of packet captures which contain untrusted data originating from network traffic. This creates a surface where an attacker could inject malicious instructions into network packets (such as HTTP request bodies or protocol metadata) that are subsequently processed and interpreted by the agent.
  • Ingestion points: Network traffic captured live via tshark -i or read from existing files via tshark -r.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the provided syntax.
  • Capability inventory: The skill enables the agent to execute shell commands and interact with the file system to manage capture data.
  • Sanitization: No sanitization, escaping, or validation of packet content is defined before the data is presented to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 02:39 AM
Security Audit — agent-trust-hub — wireshark