analyzing-network-traffic-of-malware

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

Quality

—

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Advisory

Suggest reviewing before use

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable tooling throughout and a clear six-step sequence, but it is padded with concept explanations Claude already knows and fails to point at its own bundle files, leaving progressive disclosure underused.

Suggestions

Replace or trim the 'Key Concepts' and 'Tools & Systems' sections (or move them into references/api-reference.md) since they restate concepts Claude already knows.

Add explicit one-level-deep links to the existing bundle files, e.g. 'API reference: See references/api-reference.md' and 'Automated analysis: See scripts/agent.py <malware.pcap>'.

Insert validation/verification checkpoints into the workflow (e.g. confirm extracted file hashes, verify generated Suricata rules trigger against the PCAP) to add the feedback loop the steps currently lack.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient command/code blocks, but the 'Key Concepts' and 'Tools & Systems' sections re-explain concepts (beaconing, JA3, DNS tunneling, what Wireshark/Zeek are) that Claude already knows; not score 3 because of this padded explanatory content, not score 1 because the core workflow stays lean and code-driven.	2 / 3
Actionability	Provides fully executable, copy-paste-ready tshark/scapy/suricata/zeek commands and complete Python scripts (e.g. the beacon-detection and DGA-entropy snippets), matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Six steps are clearly sequenced (overview -> DNS -> HTTP/TLS -> beaconing -> signatures -> extraction), but there are no explicit validation checkpoints or fix-retry feedback loops; not score 3 because checkpoints are implicit, and not score 1 because the sequence is well-ordered.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) but the body never signals or links to them, and inline 'Key Concepts'/'Tools' material duplicates what belongs in those references; not score 3 because references are not clearly signaled, not score 1 because sections are organized rather than a monolithic wall.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and explicitly states both capabilities and activation triggers, hitting all four dimensions at the top of the scale. It is concise without padding and uses natural trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns') and names the specific toolset (Wireshark, Zeek, Suricata), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers both what ('Analyzes network traffic... to identify C2 protocols...') and when ('Activates for requests involving...'), satisfying the highest anchor with an explicit trigger clause.	3 / 3
Trigger Term Quality	'Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection' covers natural terms a user would say (PCAP, malware, C2, network analysis); not score 2 because it spans multiple common phrasings rather than a single keyword.	3 / 3
Distinctiveness Conflict Risk	The malware-network-traffic niche with C2/PCAP-specific triggers is clearly distinct from generic packet-analysis skills and unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 673da1f

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.