analyzing-network-traffic-with-wireshark

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-network-traffic-with-wireshark/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable tshark commands and a clear step sequence, but it is padded with over-explanatory concept tables, lacks validation checkpoints in the workflow, and fails to link to the provided bundle files whose content is duplicated inline.

Suggestions

Replace the 'Key Concepts' and 'Tools & Systems' tables with brief pointers or trim them to only the non-obvious terms, since Claude already knows what BPF, TCP streams, and tshark are.

Add validation checkpoints between batch steps, e.g. verify the capture is non-empty after capture and confirm exported object counts before hashing for chain of custody.

Reference the bundle files from the body — e.g. 'See references/api-reference.md for the full filter/field catalog' and 'scripts/agent.py for scripted analysis' — and move the duplicated command catalog out of SKILL.md to avoid inlining.

Dimension	Reasoning	Score
Conciseness	The command blocks are lean and well-commented, but the 'Key Concepts' and 'Tools & Systems' tables explain well-known notions (what a TCP stream, BPF, PCAPNG, or tshark is) that Claude already knows, adding unnecessary padding.	3 / 5
Actionability	The body is dominated by copy-paste-ready, fully executable tshark commands with specific display filters, field extractions, and statistics covering the common analysis cases.	5 / 5
Workflow Clarity	Six steps are clearly sequenced and numbered, but there are no validation/verification checkpoints between steps for batch operations like capture and object export (only a final chain-of-custody hash), capping workflow clarity at 3.	3 / 5
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never referenced or signaled from the body, and the api-reference command catalog is largely duplicated inline in SKILL.md rather than split out.	2 / 5
	Total	13 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and action-rich with strong, distinct tooling triggers, but it lacks an explicit 'Use when...' trigger clause, leaving the use-case guidance only weakly implied and capping completeness.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers, e.g. 'Use when investigating network intrusions, analyzing pcap files, or responding to incidents involving suspicious traffic.'

Include the natural synonym 'pcap' or 'packet capture' in the description so it matches how users commonly phrase the request.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Captures and analyzes network packet data', 'identify malicious traffic patterns', 'diagnose protocol issues', 'extract artifacts', 'support incident response investigations' — giving comprehensive coverage of capabilities.	5 / 5
Completeness	The 'what' is clearly stated, but there is no explicit 'Use when...' trigger clause; the 'when' is only weakly implied by 'support incident response investigations on authorized network segments', capping completeness at 3 per the missing-trigger guidance.	3 / 5
Trigger Term Quality	Strong natural terms (Wireshark, tshark, network traffic, malicious traffic, incident response) that users would actually say, but missing common synonyms like 'pcap' or 'packet capture' that appear only in tags.	4 / 5
Distinctiveness Conflict Risk	A clear niche (Wireshark/tshark packet analysis on authorized network segments) with distinct tooling triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-network-traffic-with-wireshark/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.