Skill

performing-vlan-hopping-attack

skill:mukul975/anthropic-cybersecurity-skills#performing-vlan-hopping-attack

Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port security. Use during an authorized penetration test to validate trunk port hardening, confirm DTP is disabled on access ports, and demonstrate Layer 2 segmentation bypass risk to network teams.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:50 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

95/98

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-vlan-hopping-attack:skills/performing-vlan-hopping-attack/SKILL.md:175:DESTRUCT
suspicious: finding skill:skills/performing-vlan-hopping-attack:skills/performing-vlan-hopping-attack/SKILL.md:183:DESTRUCT
suspicious: finding skill:skills/performing-vlan-hopping-attack:skills/performing-vlan-hopping-attack/SKILL.md:253:MANIP

Security findings 3

Destructive action

highContextual riskhigh confidence

SKILL.md Step 4 instructs the agent to craft and send a forged VTP summary advertisement with an inflated revision number that, if accepted by switches in the VTP domain, overwrites the VLAN database across all switches and disrupts network segmentation; this VTP injection is beyond the declared switch-spoofing/double-tagging scope.

skills/performing-vlan-hopping-attack/SKILL.md:175-177

# This can overwrite VLAN database across all switches in the domain

trigger:conditionalvector:instruction

Counter-argument considered

Step 4 actively instructs the agent to craft and send a forged VTP summary advertisement with an inflated revision number, which the skill itself warns can overwrite the VLAN database across all switches; VTP injection is absent from the declared switch-spoofing/802.1Q-double-tagging scope and the 'authorized lab' comment does not neutralize the destructive capability.

Destructive action

highContextual riskhigh confidence

SKILL.md Step 4 instructs the agent to craft and send a forged VTP summary advertisement with a high revision number, a domain-wide VLAN-database overwrite capability that is undeclared (the declared description and the run_assessment API claim cover only DTP switch spoofing and 802.1Q double tagging) and which the skill itself warns can disrupt an entire switching domain.

skills/performing-vlan-hopping-attack/SKILL.md:183

# WARNING: This can disrupt the entire VLAN domain if successful

vector:instruction

Counter-argument considered

The forged high-revision VTP summary advertisement is a domain-wide VLAN-database overwrite capability that the skill itself flags as able to disrupt the entire VLAN domain; the declared description covers only DTP switch spoofing and 802.1Q double tagging, so this destructive technique is undeclared and outside every carve-out.

Manipulation

mediumContextual risklow confidence

SKILL.md Step 6 instructs the agent to run a heredoc that writes vlan_hopping_report.txt pre-filled with fabricated VULNERABLE results and a hardcoded authorization ID (PENTEST-2024-0847), which falsifies assessment documentation if executed without the corresponding test outcomes.

skills/performing-vlan-hopping-attack/SKILL.md:253-255

Result: VULNERABLE - Port negotiated trunk in 3 seconds

vector:instruction

Counter-argument considered

Step 6 instructs running a heredoc that writes vlan_hopping_report.txt pre-filled with hardcoded VULNERABLE results and a fixed authorization ID, falsifying assessment records if executed without matching outcomes; the file write is undeclared residue (DET:4910ada263816b75) contradicting the declared read-only verification posture, and no carve-out covers fabricated documentation.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Privilege escalation

highRefutedlow confidence

SKILL.md Step 2 (mirrored in scripts/agent.py send_dtp_desirable) instructs and implements sending DTP desirable frames to spoof a switch and negotiate a trunk on an access port, then creates sudo VLAN subinterfaces, which if run against a live switch converts the port to a trunk carrying all VLANs and bypasses Layer-2 segmentation.

skills/performing-vlan-hopping-attack/SKILL.md:86-87

sudo yersinia dtp -attack 1 -interface eth0

Why it was refuted

Sending DTP desirable frames to spoof a switch, negotiate a trunk, and then create sudo VLAN subinterfaces to demonstrate Layer-2 segmentation bypass is exactly the skill's declared core capability ('switch spoofing' and 'demonstrate Layer 2 segmentation bypass risk'), so the declared-core-capability carve-out applies and the behavior is declared rather than concealed or contradictory.

Coverage gaps 4

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:043d20a7156c0fd4

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:93f837d1a9635e2f

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:1c98344d095393e8

invalid_judge_finding behavior-chains.0