How to use the Malware Network Traffic Analysis agent skill

What does the skill make the agent do?

The skill's SKILL.md describes a workflow the agent follows over a PCAP file. It starts with a high-level overview using capture statistics, protocol hierarchy, top talkers, conversation statistics and a DNS query summary, all run through tshark and capinfos.

From there the workflow covers DNS activity (including a high-entropy check to flag possible DGA domains and a search for large TXT responses that may indicate DNS tunneling), HTTP and TLS traffic (requests, response bodies, POST data, SNI, JA3 fingerprints and certificate details), beaconing detection based on regular connection intervals, generation of Suricata or Snort rule drafts, and extraction of transferred files with tshark, Zeek and NetworkMiner.

• Summarise the capture and identify top talkers and conversations
• Check DNS for suspicious or algorithmically generated domains
• Inspect HTTP and TLS for command-and-control and payload downloads
• Look for periodic beaconing between hosts
• Draft Suricata or Snort detection rules from observed patterns
• Extract and hash transferred files

How do you install the skill?

Option 1: download the skill ZIP from this page and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only for that project.

Option 2: download the ZIP and upload it in the Claude apps under Settings → Capabilities → Skills.

The skill package contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep the folder structure intact after unzipping.

What do you need before you start?

The SKILL.md prerequisites list the tools the commands assume. Install them on the machine where the agent will run the commands. The skill does not install them for you.

• Wireshark 4.x for interactive PCAP analysis, including tshark for scripted extraction
• Zeek for automated metadata generation from PCAPs
• Suricata with ET Open or ET Pro rulesets for signature matching
• NetworkMiner for file extraction and credential detection
• Python 3.8+ with scapy and dpkt
• capinfos, which is part of the Wireshark tools

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language and mention the PCAP. The skill description says it activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis or network-based malware detection.

Give the agent the file path and say what you want: an overview, a check for DNS tunneling, a beacon check, or draft rules. The more context you provide about where the capture came from, the more useful the output.

• "Review malware.pcap from our sandbox run and tell me what command-and-control traffic is present."
• "Check the DNS queries in this capture for DGA-like domain names."
• "Look for periodic beaconing in capture.pcap and list the destinations."
• "Draft Suricata rules for the HTTP POST pattern you see in this PCAP."

What does a typical run look like?

For a first pass, ask the agent to start with the initial PCAP overview, then work through DNS and HTTP. Ask it to stop and explain findings at each stage so you can steer the analysis. The example commands in the skill use malware.pcap as the file name, so you can rename your capture to match or tell the agent the actual name.

When the agent drafts Suricata rules, the examples in the skill use placeholder values such as sid 9000001 and a made-up domain. Replace these with indicators from your own analysis and test rules before deploying them.

What safety precautions apply?

The skill runs scripts, so review what the agent intends to execute before approving it. The bundled scripts/agent.py computes entropy and extracts TCP payload streams with dpkt or scapy. The skill does not declare network access, but it works on malware traffic, so treat the capture and any extracted files as hazardous.

Only analyse captures in an isolated, controlled environment. The skill's own guidance says it is not for analysing live malware on a production network, because the commands and rules assume a controlled setup and could expose systems.

• Read the commands before letting the agent run them
• Do not open extracted payloads or executables on your workstation
• Keep the analysis environment isolated from production networks
• Remember that the skill is not a host-based tool and does not analyse process behaviour or memory

What tips help you get better results?

The skill is a playbook, not a verdict engine. The output depends on the analyst interpreting results, so treat each finding as a lead to verify. The beacon check uses simple thresholds (intervals between 10 and 3600 seconds and jitter under 30 percent), so a legitimate service may trigger it and real beaconing may be missed.

For host-level questions, such as process behaviour or memory, the skill itself points to sandbox reports or Volatility. Use those tools alongside this skill.

• Give the agent the context of the sandbox run, including the sample's suspected family if known
• Ask for the reasoning behind each finding, not just the result
• Validate Suricata rules against the original PCAP before using them
• Cross-check high-entropy domains and beacon hits against threat intelligence