CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-pcap-protocol

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

77

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-constructed, lean skill body: concrete actionable checklist guidance, a clearly sequenced workflow with a verification step, and clean one-level-deep progressive disclosure to a real reference file.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence — it never explains what a PCAP or protocol is — and every section earns its place, matching the score-3 'lean and efficient' anchor rather than the padded score-2 example.

3 / 3

Actionability

As an instruction-only skill it provides concrete, specific guidance with named checklist items (e.g., 'hosts, time span, interfaces, missing packets, retransmits' and 'endpoints, protocols, ports, TLS handshakes, DNS lookups, websocket upgrades'), which the rubric notes should not be penalized for lacking code.

3 / 3

Workflow Clarity

A clear 5-step Quick Start and 3-phase Workflow are explicitly sequenced, with a verification checkpoint ('Reproduce the smallest decoded stream or transferred artifact that proves the challenge path') and reassembly guards before drawing conclusions.

3 / 3

Progressive Disclosure

The SKILL.md is a concise overview that points one level deep to a real, clearly signaled references/pcap-protocol.md (verified present), with content appropriately split and easy to navigate.

3 / 3

Total

12

/

12

Passed

Description

92%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description with explicit 'what' and 'when' triggers and natural user-facing terminology. Its only weakness is trigger overlap with named sibling skills on WebSocket/custom-protocol decoding.

Suggestions

Narrow the WebSocket/custom-C2 triggers to a PCAP context (e.g., 'decode WebSocket/custom C2 traffic captured in a PCAP') to reduce overlap with $competition-websocket-runtime and $competition-custom-protocol-replay.

Lead with the PCAP-packet-capture trigger so the description's primary signal is the capture file rather than the protocol family.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions such as 'packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation', matching the score-3 anchor rather than the single-domain score-2 example.

3 / 3

Completeness

Explicitly answers both what (the listed analysis/decoding actions) and when ('Use when the user asks to analyze a PCAP...'), satisfying the score-3 anchor for explicit triggers on both halves.

3 / 3

Trigger Term Quality

Covers natural phrasings a user would actually say — 'analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2' — giving good coverage of common variations rather than only jargon.

3 / 3

Distinctiveness Conflict Risk

The PCAP framing gives a clear niche, but 'decode HTTP, WebSocket, DNS, custom C2, or binary protocols' overlaps with the sibling skills the body itself routes to ($competition-websocket-runtime, $competition-custom-protocol-replay), so it could still trigger for a related skill.

2 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.