analyzing-network-covert-channels-in-malware

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or attributing exfiltration traffic to a known tunneling toolset.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable thanks to a complete executable script, but it is held back by padded/time-sensitive overview prose, a single-step workflow lacking integrated validation checkpoints, and orphaned bundle files that the body never navigates to.

Suggestions

Trim the Overview's explanatory and time-sensitive filler (the 99% recall claim and the 2024 Unit42 campaign names) so it stays lean and does not decay over time.

Turn the Workflow into a real sequenced process (e.g., collect PCAP -> run DNS analysis -> run ICMP analysis -> validate against the criteria) with explicit validation checkpoints, and complete the missing steps beyond Step 1.

Move the inlined detection script to scripts/agent.py and add clearly signaled one-level-deep links to references/workflows.md, references/api-reference.md, and assets/template.md so the bundle is actually discoverable.

Dimension	Reasoning	Score
Conciseness	The Overview explains concepts Claude already knows ("Malware uses covert channels to disguise C2 communication...") and adds time-sensitive padding ("99%+ recall" and the 2024 Unit42 campaigns TrkCdn/SecShow/Savvy Seahorse) that does not earn its tokens.	2 / 3
Actionability	The Workflow ships a complete, executable scapy script with real DNS/ICMP tunneling detection functions and a runnable `__main__` block — copy-paste ready, not pseudocode.	3 / 3
Workflow Clarity	Only "Step 1: DNS Tunneling Detection" is labeled with no Step 2+, and the Validation Criteria are listed separately rather than sequenced with checkpoints or feedback loops, leaving the multi-step process incomplete.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, standards.md, workflows.md, scripts/agent.py, assets/template.md) but none are referenced in the body, and the full detection script is inlined in SKILL.md rather than pointing to scripts/agent.py — content that should be separate is inline and provided references are not signaled.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely names the capability and channel types and pairs it with an explicit, natural-language "Use when" trigger clause. It is specific, complete, and distinct from neighboring skills.

Dimension	Reasoning	Score
Specificity	"Detect and analyze covert communication channels... including DNS tunneling, ICMP exfiltration, steganographic HTTP" names multiple concrete actions and specific channel types, matching the anchor that lists several specific concrete actions.	3 / 3
Completeness	It states what the skill does ("Detect and analyze covert communication channels...") and gives an explicit "Use when..." trigger clause, clearly answering both what and when.	3 / 3
Trigger Term Quality	"suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, attributing exfiltration traffic" are natural terms a SOC analyst would say, giving good coverage of likely user phrasings.	3 / 3
Distinctiveness Conflict Risk	The niche is narrow (network covert channels in malware) with distinct triggers (DNS/ICMP/HTTP tunneling, C2, exfiltration), making it unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-network-covert-channels-in-malware/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.