CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-pcap-protocol

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

75

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured instruction-only skill body that assumes Claude's knowledge, gives concrete analysis steps in a clear sequence, and cleanly offloads checklists to a single real one-level-deep reference. It loses a little on actionability and workflow clarity only because it offers no executable tool commands and no explicit error-recovery feedback loop.

Suggestions

Add one or two concrete executable commands for the most common decode step (e.g. a tshark/scapy stream-reassembly snippet) to push actionability from instructional to copy-paste-ready.

Add an explicit validate→fix→retry checkpoint after the decode phase (e.g. "If a stream fails to reassemble cleanly, check for missing segments or asymmetric capture before re-interpreting fields") to introduce a feedback loop.

Optionally surface the reference file's checklists by name in the body (First Pass / Decode Order) so the navigation target is even more discoverable.

DimensionReasoningScore

Conciseness

Lean ~50-line body that assumes Claude's competence — it never explains what a PCAP, TCP, or TLS handshake is, and each line (e.g. "Reassemble TCP streams or UDP conversations before interpreting fields") earns its place, matching the lean/efficient top anchor.

5 / 5

Actionability

Concrete, specific instructional guidance ("Establish the capture boundaries first: hosts, time span, interfaces, missing packets, retransmits, and stream count") but, as an analysis/decision skill, it provides no executable commands or code (e.g. tshark/scapy snippets), placing it just below the copy-paste-ready top anchor.

4 / 5

Workflow Clarity

A clear five-step Quick Start plus three sequenced Workflow phases with a proof-style checkpoint ("Reproduce the smallest decoded stream... that proves the challenge path") and a pre-conclusion check ("Note missing capture coverage... before drawing conclusions"), but it lacks an explicit validate→fix→retry feedback loop, sitting below the top anchor.

4 / 5

Progressive Disclosure

Body is an overview that clearly signals a one-level-deep, real reference ("Load `references/pcap-protocol.md` for the session checklist, decode checklist, and evidence packaging") — the file exists and holds those checklists — and routes special cases to sibling skills, matching the well-signaled one-level-deep top anchor.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that names concrete capabilities, provides comprehensive natural triggers, answers both what and when explicitly, and uses an explicit downstream-routing boundary to minimize conflict risk. It stays in third-person imperative form consistent with the rubric's good examples.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation" — giving comprehensive coverage of the PCAP-analysis domain, matching the anchor for multiple specific concrete actions rather than the 4-anchor's 'minor gaps'.

5 / 5

Completeness

Explicitly answers both: what ("CTF-sandbox workflow for packet capture analysis, session reconstruction...") and when ("Use when the user asks to analyze a PCAP..."), with concrete trigger phrases, matching the top anchor.

5 / 5

Trigger Term Quality

Natural trigger phrasing is comprehensive: "analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior" — covering synonyms and named protocols a CTF user would actually say.

5 / 5

Distinctiveness Conflict Risk

Clear niche (PCAP/protocol decoding) reinforced by an explicit routing boundary — "Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here" — which minimizes conflict risk by deferring selection to the orchestrator.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.