How to use the Protocol Reverse Engineering agent skill

What an agent skill is and what this one does

An agent skill is a folder of instructions and reference files that an AI agent loads when a task matches its description. This skill is defined by a SKILL.md file and a references/protocol-workflow.md cheat sheet.

Once triggered, the skill guides the agent through four phases: triaging a capture, working out frame layouts, recovering Protobuf or gRPC message definitions, and producing outputs. The required outputs are a message type table (name, opcode and fields), at least one reproducible decoding command or script, and redacted evidence made of raw hex excerpts and decoded results.

• Phase 1: collect samples, mark direction (client to server or server to client), and look for magic numbers, length fields, or TLV structures.
• Phase 2: align similar messages to find constant bytes and sequence numbers, check length-field endianness, look for CRC or HMAC fields, and sketch the state machine.
• Phase 3: recover .proto definitions for Protobuf, inspect HTTP/2 headers and protobuf bodies for gRPC, and locate key derivation for encrypted frames.
• Phase 4: deliver the message table, a decoding script, and redacted evidence.

Install the protocol-reverse skill

Download the ZIP for the skill from this page, then choose one of two install routes.

For Claude Code, unzip the package into your personal skills folder ~/.claude/skills/ or into a project-level .claude/skills/ folder inside your project. For the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

• Personal install: place the unzipped protocol-reverse folder in ~/.claude/skills/.
• Project install: place it in the .claude/skills/ folder of the project you are working in.
• Claude apps: upload the ZIP under Settings → Capabilities → Skills.

Prepare your tools before the first run

The skill expects Python 3 for decoding scripts. Wireshark or tshark is strongly recommended for parsing PCAP files. The source notes that tshark may need a manual install, for example through winget on Windows.

Optional tools include blackboxprotobuf and pbtk for unknown Protobuf, ImHex or 010 Editor for structure templates, and Kaitai Struct for binary format descriptions. For client binary analysis, the skill refers to IDA, radare2 or Ghidra through other skills.

• Required: Python 3.
• Strongly recommended: tshark / Wireshark.
• Optional: blackboxprotobuf, pbtk, ImHex or 010 Editor, Kaitai Struct.
• Optional, via referenced skills: IDA, radare2, Ghidra.

Trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions the protocol, traffic, or capture, and the agent will match it to this skill. Name the file and the protocol type where you can.

Include your authorization context in the request. The skill tells the agent to confirm scope before interacting with any target, so a request that states the scope gives it what it needs.

• "I have authorization to test this app. Analyse cap.pcap and work out the frame layout of its custom TCP protocol."
• "Recover a .proto schema from these captured gRPC messages in traffic.pcapng."
• "Decode the WebSocket frames in this capture and produce a message type table with a reproducible decoding script."
• "Find the length field and checksum in these binary samples from the client log."

Work through an example capture

Start by extracting TCP payloads on the port you are analysing. The reference file includes a tshark filter for a specific port, which you can adapt to your own capture.

Then ask the agent to compare several messages of the same type. Constant bytes often mark headers or message types, while counters point to sequence numbers. The reference notes that length fields may be big-endian or little-endian and may or may not include the header length, so check each possibility against the data.

Safety, scope and redaction

The skill is for authorized work only. Its own rules say to check scope before interacting with a target, and not to send anything to a target whose authorization has not been granted. Replay is only for the authorized scope, and the skill advises testing harmless fields before sensitive operations, because a risky replay could harm live services.

The skill runs scripts and uses the network. It references a ../scripts/case-init.ps1 scope script and sibling skills that are not included in the provided files, so you may need to supply those yourself. Redact sensitive data in all evidence.

• Confirm written authorization and scope before any live interaction.
• Replay only within the authorized scope, starting with harmless fields.
• Redact secrets, tokens and personal data from hex excerpts and decoded output.
• The referenced case-init.ps1 script and sibling skills are not included in the provided files.

Tips for better results

Give the agent several samples of the same message type rather than one, since alignment across messages is how constant and changing bytes are found. Provide a PCAP where possible, because the skill is built around captured traffic.

If the traffic is encrypted, the skill looks for key derivation in client code and suggests related skills. Expect to supply the client binary or its JavaScript when that is the case.

• Provide at least several messages of the same type.
• Provide PCAP or PCAPNG captures when you have them.
• For encrypted frames, include the client binary or script that derives the key.