How to use the C2 Communication Analysis agent skill

What the skill makes the agent do

The skill covers analysis of command-and-control (C2) communication over HTTP, HTTPS, DNS and custom protocols. Its stated purpose is to help reverse-engineer beacon patterns, command structures, data encoding and infrastructure such as primary servers, fallback domains and dead drops.

Working from a packet capture (PCAP), the agent follows a workflow: identify the C2 channel, analyze the beacon pattern, decode the protocol structure, match traffic to known frameworks such as Cobalt Strike, Metasploit, Sliver, Covenant or PoshC2, and map the infrastructure. The skill also includes a Python script, scripts/agent.py, and a reference file, references/api-reference.md, covering scapy and dpkt usage.

• Flags likely beacons by measuring connection timing and jitter
• Decodes HTTP request URIs, headers and Base64 bodies from captured traffic
• Lists known default URIs and signatures for several C2 frameworks
• Suggests threat intelligence lookups (VirusTotal, Shodan, Censys) for infrastructure correlation

Install the skill (ZIP download or Claude apps upload)

Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Install the tools the skill needs

The skill expects Python 3.8 or newer and the scapy, dpkt and requests Python libraries. Wireshark or tshark is needed for packet-level checks. Ghidra or dnSpy is optional and is referenced for manual reverse engineering of the malware binary. Threat intelligence accounts such as VirusTotal, Shodan or Censys are optional and only needed for infrastructure correlation.

The skill's own examples install one optional helper with pip, the CobaltStrikeParser package. Use the package names shown in the skill; the skill does not give a full install command for the other libraries.

Trigger the skill with natural requests

You do not need a special command. Describe the task in plain language and mention the capture or framework. The skill's description says it applies after reverse engineering reveals network traffic that needs protocol analysis, or when building detection signatures for a framework such as Cobalt Strike, Metasploit or Sliver.

Give the agent the PCAP file path and say what you want to learn. Be specific about the question you need answered.

• "Analyze c2_traffic.pcap and tell me whether any destination shows beaconing."
• "This sample talks over HTTPS. Decode the request format and tell me which framework it resembles."
• "Map the primary and fallback domains in this capture and list the ports used."
• "Help me write network detection signatures for the Sliver traffic in this PCAP."

Check results and understand the limits

The beacon script reports a destination as a beacon when its average interval is between 5 and 7200 seconds and its jitter is under 25 percent. These thresholds are set in the example code and are not universal, so treat a flag as a lead to verify rather than a verdict.

The skill is for known or suspected C2 protocols found during malware analysis. It is not a general anomaly detector and does not monitor live traffic or block anything. Its attribution guidance produces technical indicators only, so experts should verify any link to a threat actor.

• Works on saved captures only
• Not designed for general network anomaly detection
• Attribution output needs expert verification

Safety notes before running scripts and network calls

This skill runs scripts and uses the network. Its infrastructure example sends indicator IP addresses to the Shodan API, so only use this with an API key you are allowed to use and with indicators you are permitted to share. Review scripts/agent.py before running it, and analyze suspect binaries and traffic in an isolated environment such as a sandbox.

The skill is licensed under Apache-2.0. Read the licence text in the ZIP before reuse or redistribution.

• Read scripts/agent.py before running it
• Analyze malware samples and captures in an isolated environment
• Lookups to Shodan and similar services send indicator data to third parties

Tips for better results

Start with a clean capture that contains only the suspect host's traffic, because the beacon script groups connections by destination. Give the agent a sandbox PCAP along with any notes from reverse engineering, since the skill is designed to follow that work.

• Use at least three connections per destination for beacon checks, as the script skips destinations with fewer
• Ask for the channel type first (HTTP, DNS, custom TCP, ICMP and so on) before asking for decoding
• Ask the agent to compare results with the framework signatures it lists