analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building detection signatures for a framework like Cobalt Strike, Metasploit, or Sliver.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-command-and-control-communication/SKILL.md

Quality

Content

62%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured C2 analysis skill with strong executable examples, but it would benefit from validation checkpoints in the workflow and from pushing reference catalogs into the existing bundle files rather than inlining them.

Suggestions

Add validation checkpoints between workflow steps (e.g., confirm the PCAP parsed and streams reassembled before decoding, verify a matched framework signature against a second indicator before labeling, and test generated Suricata rules against the sample capture).

Move the large framework-signature catalog and the full output-format template into references/api-reference.md (or a new references file) and link to them from the body, since they are reference material rather than core procedure.

Reference scripts/agent.py and references/api-reference.md explicitly from the relevant workflow steps so the provided bundle files are actually wired into the skill navigation.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable code, but the large ASCII channel table, full framework-signature catalog, and complete output-format template add bulk that assumes little of Claude's existing malware-analysis knowledge.	3 / 5
Actionability	Provides fully executable, copy-paste-ready Python (scapy, dpkt, requests), bash, and Suricata rule examples that cover the common C2 analysis cases end to end.	5 / 5
Workflow Clarity	Six numbered steps give a clear sequence, but this is a batch/analysis-over-PCAP workflow with no validation checkpoints confirming captures parsed correctly, framework IDs verified, or signatures tested before use, which caps the score at 3.	3 / 5
Progressive Disclosure	Well-organized sections with two real bundle files (references/api-reference.md, scripts/agent.py), but the body inlines large reference-style catalogs (framework signatures, output template) instead of pointing to them, and the bundle files are never referenced from the body.	3 / 5
	Total	14 / 20 Passed

Description

90%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to use it, with concrete domain terms and named C2 frameworks. Minor room for additional natural synonyms, but overall excellent.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('reverse-engineer beacon patterns, command structures, data encoding, and infrastructure') with comprehensive coverage across protocols, matching the multiple-specific-actions anchor.	5 / 5
Completeness	Explicitly answers what ('Analyzes malware C2 communication...to reverse-engineer...') and when ('Use after reverse engineering reveals network traffic...or when building detection signatures'), matching the both-what-and-when anchor.	5 / 5
Trigger Term Quality	Strong natural keywords ('C2 communication', 'beacon patterns', 'detection signatures', Cobalt Strike/Metasploit/Sliver) but missing some common synonyms or file extensions a user might naturally say.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (malware C2 protocol analysis with named frameworks) with distinct triggers and minimal conflict risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-command-and-control-communication/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.