analyzing-network-covert-channels-in-malware

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or attributing exfiltration traffic to a known tunneling toolset.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-network-covert-channels-in-malware/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body provides executable, concrete code and clear section organization, but suffers from a truncated single-step workflow, concept explanation and time-sensitive padding in the Overview, and a bundle that is never navigated to from the SKILL.md. These issues hold the content scores in the mid-range.

Suggestions

Replace the inlined ~140-line DNS/ICMP script with a brief usage snippet and a pointer to scripts/agent.py, and add a References subsection linking references/api-reference.md (entropy thresholds, tool tables), references/workflows.md, and assets/template.md so the bundle is discoverable.

Complete the Workflow with the missing steps (e.g. Step 2 ICMP, Step 3 HTTP header steganography, Step 4 protocol anomalies) or restructure as a single unambiguous procedure, and integrate the Validation Criteria as explicit validate->fix->retry checkpoints inside the workflow.

Trim the Overview to drop explanations of what DNS/ICMP/HTTP tunneling are and move the '99%+ recall' statistic and 2024 campaign references out of the main body (or into a clearly marked context/deprecated section) to reduce token cost.

Dimension	Reasoning	Score
Conciseness	The Overview explains concepts Claude already knows (what DNS/ICMP/HTTP tunneling is), includes a time-sensitive 2024 campaign reference and a '99%+ recall' stat not placed in a deprecated section, and inlines a ~140-line script that duplicates scripts/agent.py; it is mostly efficient but carries clear padding and redundancy.	3 / 5
Actionability	The inline Python is fully executable and copy-paste ready with a working main block, but it only covers DNS and ICMP detection while the description also promises HTTP steganography and protocol abuse detection, leaving a coverage gap.	4 / 5
Workflow Clarity	The Workflow is labeled 'Step 1: DNS Tunneling Detection' with no Step 2 or later steps, and a separate Validation Criteria section lists outcomes but is not integrated as validate->fix->retry feedback loops within the workflow, leaving checkpoints implicit.	3 / 5
Progressive Disclosure	Section structure is well organized (Overview, When to Use, Prerequisites, Workflow, Validation Criteria, References), but none of the six bundle files (references/api-reference.md, standards.md, workflows.md, scripts/agent.py, assets/template.md) are referenced from the body, and a large script is inlined rather than pointing to the existing scripts/agent.py.	3 / 5
	Total	13 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong, clearly answering both what the skill does and when to use it with concrete, domain-specific trigger phrases and a well-scoped niche. Minor gaps in action verb variety and synonym coverage keep specificity and trigger term quality at 4 rather than 5.

Dimension	Reasoning	Score
Specificity	Concrete actions 'Detect and analyze covert communication channels' plus a third implicit action 'attributing exfiltration traffic' are stated, with comprehensive enumeration of DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse; the action vocabulary is somewhat narrow (mostly detect/analyze), keeping it just below a 5.	4 / 5
Completeness	It explicitly states what the skill does ('Detect and analyze covert communication channels used by malware...') and when to use it ('Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels...') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Natural analyst-facing terms like 'DNS tunneling', 'suspicious DNS/ICMP/HTTP traffic patterns', 'hidden C2 channels', 'network captures', and 'exfiltration traffic' are present, but common synonyms such as PCAP, beaconing, or threat hunting are missing, so it is not fully comprehensive.	4 / 5
Distinctiveness Conflict Risk	The niche is clearly scoped to malware network covert channels with distinct triggers (DNS tunneling, ICMP exfiltration, steganographic HTTP, tunneling toolset attribution), giving it minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-network-covert-channels-in-malware/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.