analyzing-network-flow-data-with-netflow

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-network-flow-data-with-netflow/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and actionable with a clear step sequence, but it lacks validation checkpoints in its batch workflow and fails to link the existing API reference, capping two dimensions at 3.

Suggestions

Add a validation step between parsing and analysis (e.g. verify flow count and required fields are non-empty before building baselines) to lift workflow clarity.

Link the existing `references/api-reference.md` from the body (e.g. under an 'API reference' subsection) so the bundled reference is clearly signaled.

Provide runnable code for at least one detection pattern (e.g. port-scan or C2-beaconing) instead of prose-only descriptions to push actionability higher.

Dimension	Reasoning	Score
Conciseness	The body is lean and avoids explaining NetFlow concepts Claude already knows, though the 'When to Use' bullets are somewhat generic/templated and could be tightened further.	4 / 5
Actionability	Concrete, executable guidance is present (`pip install netflow`, the collector command, `netflow.parse_packet()`, and the agent.py invocation), but the detection patterns are described in prose rather than runnable code.	4 / 5
Workflow Clarity	Steps 1–5 are sequenced, but the batch flow-analysis workflow has no validation or verification checkpoints (e.g. confirming parsed data or baseline sanity), which caps workflow clarity at 3 per the rubric.	3 / 5
Progressive Disclosure	Sections are organized and `scripts/agent.py` is referenced (and exists), but `references/api-reference.md` is present in the bundle yet never linked from the body, leaving an un-signaled reference.	3 / 5
	Total	14 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and capability-rich with a clear distinct niche, but it lacks an explicit 'when to use' trigger clause, which caps its completeness and leaves it just short of the top tier.

Suggestions

Append an explicit trigger clause such as 'Use when analyzing NetFlow/IPFIX flow records for volumetric anomalies, port scanning, data exfiltration, or C2 beaconing.' to raise completeness.

Add common user-facing synonyms like 'network flow analysis' or 'flow records' to broaden natural trigger term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — parsing NetFlow v9/IPFIX, detecting volumetric anomalies, port scanning, data exfiltration, C2 beaconing, building baselines, and statistical analysis — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	The 'what' is clearly stated, but there is no 'Use when…' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric guidelines.	3 / 5
Trigger Term Quality	Natural domain terms like 'NetFlow v9', 'IPFIX', 'port scanning', 'data exfiltration', and 'C2 beaconing' are present, but common synonyms and variations a user might say (e.g. 'network flows', 'flow analysis') are missing.	4 / 5
Distinctiveness Conflict Risk	The NetFlow v9/IPFIX flow-analysis niche is mostly distinct with specific triggers, though there is minor overlap risk with broader network-monitoring or security-analysis skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-network-flow-data-with-netflow/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.