protocol-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several powerful networking utilities for traffic capture and analysis.
- Includes usage of
wireshark,tshark,tcpdump, andmitmproxyto monitor network interfaces (e.g.,eth0) and intercept HTTP/HTTPS traffic. - Provides scripts for packet injection and modification using the
scapylibrary (send(pkt)). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its core functionality of processing external data.
- Ingestion points: Reads untrusted data from network interfaces (
-i eth0) and external capture files (rdpcap("capture.pcap")). - Boundary markers: The provided scripts lack explicit boundary markers or instructions to ignore embedded commands within captured protocol data.
- Capability inventory: The skill has high-impact capabilities including arbitrary packet injection (
scapy.send), transparent proxying (mitmproxy), and shell command execution for analysis tools. - Sanitization: There is no evidence of sanitization or validation of the data extracted from network packets before it is processed by the agent or documented.
Audit Metadata