analyzing-network-traffic-of-malware

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands across a clear six-step workflow, and prose is mostly lean. The main weakness is progressive disclosure: bundle files exist but are never referenced, and inline reference material duplicates what should live in the separate reference file.

Suggestions

Link the bundle files from the body, e.g. add an 'API reference: See references/api-reference.md' and 'Automation helper: See scripts/agent.py <malware.pcap>' section so the existing bundle is discoverable.

Move the bulk of the inline tshark/Suricata command catalog into references/api-reference.md, keeping only a representative example per workflow step in SKILL.md to reduce duplication.

Trim the 'Key Concepts' and 'Tools & Systems' sections to only malware-analysis-specific nuances Claude would not already know, cutting restated definitions of Wireshark, Zeek, beaconing, etc.

Dimension	Reasoning	Score
Conciseness	The body is code- and command-heavy with lean one-line section intros, but the 'Key Concepts' table and 'Tools & Systems' list re-explain fairly standard cybersecurity concepts and tools that Claude already knows.	4 / 5
Actionability	Provides fully executable, copy-paste-ready tshark, Suricata, Zeek, and Python snippets that cover the common analysis cases (DNS, HTTP/TLS C2, beaconing, signature generation, file extraction).	5 / 5
Workflow Clarity	Six clearly sequenced steps (overview -> DNS -> HTTP/C2 -> beaconing -> signatures -> extraction) form a coherent read-only analysis pipeline, though explicit validation checkpoints between steps are implicit rather than stated.	4 / 5
Progressive Disclosure	The body is well-sectioned but inlines substantial command/API reference material that overlaps with the existing references/api-reference.md, and neither api-reference.md nor scripts/agent.py is ever linked from the body, leaving bundle references un-signaled.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, names the toolset, and provides an explicit activation clause covering natural trigger phrases. The only minor gap is missing synonyms and the literal .pcap extension in the trigger list.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns') and names the tools (Wireshark, Zeek, Suricata), giving comprehensive coverage of capabilities.	5 / 5
Completeness	Explicitly answers 'what' (analyzes malware network traffic to identify C2/exfiltration/payloads/lateral movement) and 'when' via the 'Activates for requests involving...' trigger clause.	5 / 5
Trigger Term Quality	Includes natural phrases like 'malware network analysis', 'C2 traffic decoding', and 'malware PCAP analysis', but omits synonyms and the literal '.pcap' file extension, leaving a few common terms missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (malware network traffic analysis) with distinct, malware-specific triggers, minimizing conflict risk with adjacent network-analysis skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-network-traffic-of-malware/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.