wireshark-analysis

This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/wireshark-analysis/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A comprehensive, well-structured Wireshark reference with strong actionable filter examples and a clear phase-based workflow. Its main weaknesses are padding from prerequisite/concept explanations and a monolithic structure that inlines reference material instead of splitting it into bundled files.

Suggestions

Trim the Inputs/Prerequisites and Use Cases sections to only what is non-obvious (e.g., drop 'Knowledge of OSI model layers' and 'Understanding of common attack patterns', which Claude already knows).

Move the bulk Common Filter Reference and Keyboard Shortcuts tables into separate bundled reference files (e.g. references/filters.md, references/shortcuts.md) and link to them from SKILL.md so the body stays an overview.

Add explicit validation checkpoints to the workflow (e.g., confirm a filter turns green before relying on it, verify Expert Information shows no errors after analysis) to lift workflow clarity.

Dimension	Reasoning	Score
Conciseness	The filter reference and tables are dense and earn their tokens, but the Inputs/Prerequisites and Use Cases sections restate concepts Claude already knows (OSI model, common attack patterns) and could be trimmed.	3 / 5
Actionability	Concrete, copy-paste-ready Wireshark display/capture filter expressions and explicit menu paths (Statistics > Protocol Hierarchy) cover the common cases; minor gaps such as UI-only "Follow Stream" steps keep it just below fully executable.	4 / 5
Workflow Clarity	Phases 1–6 are clearly sequenced and the Troubleshooting section provides recovery guidance; the skill is read-only analysis so the destructive-operation cap does not apply, but there are no explicit validation checkpoints on analysis output.	4 / 5
Progressive Disclosure	Well-organized with clear headers, but it is a single monolithic file with bulk reference material (filter syntax, keyboard shortcuts, statistics) that could live in separate one-level-deep reference files rather than inlined in SKILL.md.	3 / 5
	Total	14 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with explicit trigger guidance and a clear Wireshark-specific niche. The only minor weakness is that the capability sentence is somewhat condensed compared to the breadth implied by the trigger list.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions ("network packet capture, filtering, and analysis"), reinforced by trigger phrases like follow streams and detect anomalies; not a 5 because the core capability statement is condensed rather than a full enumerated list.	4 / 5
Completeness	Explicitly answers both what ("comprehensive techniques for network packet capture, filtering, and analysis") and when (the "should be used when the user asks to..." trigger list), in third person.	5 / 5
Trigger Term Quality	Seven quoted natural phrases ("analyze network traffic with Wireshark", "filter PCAP files", "follow TCP/UDP streams") with synonyms and file formats cover what users would actually say.	5 / 5
Distinctiveness Conflict Risk	Anchored to Wireshark and PCAP files with distinctive triggers, giving it a clear niche with minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/wireshark-analysis/SKILL.md
Commit: 9d252b3

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.