analyzing-network-traffic-for-incidents
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
85
82%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines its scope (network traffic forensics for security incidents), lists specific capabilities and tools, and provides explicit activation triggers. It uses proper third-person voice throughout and covers natural user terminology comprehensively. The description is concise yet thorough, making it easy for Claude to select this skill precisely when needed.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: analyzing network traffic captures, identifying C2 communications, lateral movement, data exfiltration, and exploitation attempts. Also names specific tools (Wireshark, Zeek, NetFlow). | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes network traffic captures to identify adversary activity including C2, lateral movement, exfiltration) and 'when' (explicit 'Activates for requests involving...' clause with specific trigger scenarios). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a user would say: 'network traffic analysis', 'packet capture', 'PCAP analysis', 'network forensics', 'C2 traffic detection', 'exfiltration detection', plus domain terms like 'command-and-control', 'lateral movement'. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused on network traffic/packet capture forensics during security incidents. The specific mention of PCAP, Wireshark, Zeek, C2 detection, and exfiltration clearly distinguishes it from general security or general network skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a solid, actionable network forensics skill with excellent concrete examples including real tcpdump commands, Zeek log parsing pipelines, and Wireshark filters. Its main weaknesses are verbosity from unnecessary concept definitions that Claude already knows, and the absence of explicit validation/verification checkpoints in the workflow. The document would benefit from trimming the glossary and tool descriptions and adding verification steps between workflow stages.
Suggestions
Remove or move the Key Concepts glossary table and Tools & Systems descriptions to a separate reference file — Claude already knows what PCAP, Wireshark, and DNS tunneling are.
Add explicit validation checkpoints in the workflow, such as verifying PCAP file integrity (capinfos), confirming capture covers the investigation timeframe, and validating filter results before proceeding to analysis.
Split detailed content (scenario walkthroughs, output format template, tool references) into separate linked files to keep the main SKILL.md as a concise overview with navigation.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill includes some unnecessary content like the Key Concepts glossary table (Claude knows what PCAP, NetFlow, and DNS tunneling are) and the Tools & Systems descriptions explaining what Wireshark and Zeek are. The core workflow sections are reasonably efficient, but the overall document could be tightened by removing definitions of well-known concepts. | 2 / 3 |
Actionability | The skill provides fully executable commands (tcpdump, Zeek log parsing with zeek-cut and awk), specific Wireshark display filters, and concrete examples throughout. The commands are copy-paste ready with realistic IPs and parameters, and the scenario walkthrough gives a clear step-by-step approach. | 3 / 3 |
Workflow Clarity | The six-step workflow is clearly sequenced and covers the full investigation lifecycle from capture to reporting. However, there are no explicit validation checkpoints or feedback loops — for instance, no step to verify PCAP integrity, confirm capture completeness, or validate that filters are returning expected results before proceeding. Given that network forensics involves potentially destructive time-sensitive operations, the lack of verification steps caps this at 2. | 2 / 3 |
Progressive Disclosure | The content is well-structured with clear headers and logical sections, but it's a monolithic document (~200+ lines) with no references to external files for detailed content like the full IOC extraction procedures, the glossary, or the tools list. The Key Concepts table and Tools & Systems section could be split into separate reference files to keep the main skill lean. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
888bbe4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.