tcpdump

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill repeatedly instructs use of sudo for packet captures and even suggests adding a user to the wireshark/pcap group or setting capabilities (actions that require elevated privileges and change system state), so it encourages obtaining elevated privileges and modifying the machine's configuration.