skills/mukul975/anthropic-cybersecurity-skills/implementing-ot-network-traffic-analysis-with-nozomi/Gen Agent Trust Hub
implementing-ot-network-traffic-analysis-with-nozomi
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution through
subprocess.runinscripts/agent.pyto invokecurl. This command specifically uses the-kflag to disable SSL/TLS certificate verification. Similarly, theNozomiGuardianManagerclass inSKILL.mddefaults to disabling SSL verification (verify_ssl=False), exposing communications to potential man-in-the-middle attacks.\n- [PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection due to its handling of untrusted data from the Nozomi Guardian API.\n - Ingestion points: The skill retrieves alert descriptions, asset inventory labels, and network session details via API endpoints in
scripts/agent.pyandSKILL.md.\n - Boundary markers: Absent. No delimiters or instructions are provided to the agent to treat external data as untrusted.\n
- Capability inventory: The skill can execute shell commands (via subprocess) and perform outbound network requests.\n
- Sanitization: Absent. The retrieved data is processed and printed to standard output without any filtering, validation, or escaping of potentially malicious content.
Audit Metadata