traffic-analysis SKILL.md skillA
traffic-analysis from cristallin2006/ghidra-skill-for-dsh is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cristallin2006/ghidra-skill-for-dsh/traffic-analysis@git:20260928.af4f3a7Pins git:20260928.af4f3a7 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cristallin2006/ghidra-skill-for-dsh
- Path
traffic-analysis/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260928.af4f3a7, committed Sep 28, 2026
- First version recorded
- Sep 20, 2026
- Size
- 9,357 bytes
- Repository stars
- 11
- License
- MIT
CTF 流量分析与网络取证（pcap / network forensics）：pcap 分诊、DNS/ICMP/TCP 隐信道与隧道重组（covert channel / tunneling）、USB HID 键鼠抓包还原、WPA/TLS 解密、文件与凭据提取。触发：流量/pcap/抓包/Wireshark/tshark/网络取证/流量包/隐蔽信道/隧道。不做二进制逆向——那是 ghidra-static 系；提取出的文件需逆向时回 re-triage。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Traffic Analysis（场景 6：流量里找信号） 前置：拿到 pcap/pcapng（题目附件，或别的主线提取出的文件）／后继：提取出的二进制 → `~/.dsh/skills/re-triage` 重新分诊；文本/flag 类结论直接交付 > **内容看不懂时，信号在元数据里**：包长、TTL、IPID、时延、TCP flags 的 per-packet 分布画直方图，值落在可打印 ASCII 区间的分布就是信号（TokyoWesterns 2018 方法论，细节 references/tunnels.md §通用检测）。同一路径失败 2 次换工具，单方向 ≤15 分钟（铁律 6，全文见 ghidra-core §1）。 ## 路径约定 ```bash TA="$HOME/.dsh/skills/traffic-analysis/scripts" # 本 skill 脚本（全零依赖，Python 3 stdlib） # Windows: TS="$HOME/Desktop/src/tools/wireshark/tshark.exe" # tshark 4.6.8（7z 免安装解包；未加 PATH，用全路径） EC="$HOME/Desktop/src/tools/wireshark/editcap.exe" # editcap（pcapng→pcap 转换） # WSL/Linux（apt 安装，PATH 直达）: # TS="$(command -v tshark)"; EC="$(command -v editcap)" ``` 本 skill 不依赖 tshark——`pcap_triage.py` / `conflict_oracle.py` / `decode_engine.py` 自研解析器保底（全 stdlib）；tshark/editcap/scapy/aircrack-ng/hashcat 是否可用以 `python "$SK/doctor.py"` 的 toolchain 节为准（SK 路径见 ghidra-core），缺失按 hint 装或绕。ghidra-core 的 unreferenced_data.py / ledger.py 仅为路由引用，非本 skill 脚本的运行依赖。 ## 流程 ### 1. 打不开先修 `xxd cap.pcap | head -1` 对 magic bytes（d4c3b2a1/a1b2c3d4=pcap，0a0d0d0a=pcapng）→ 修头/pcapfix/格式转换，配方见 `references/pcap-triage.md` §修复。 ### 2. 开局三连（每条 30 秒内） ```bash …
Read the whole file at its exact version.
How to install
mdr add cristallin2006/ghidra-skill-for-dsh/traffic-analysis@sha256:c7dac4d61ea1129bThe line at the top of this page pins the label git:20260928.af4f3a7, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_77r5qcym555ppqtz)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Sep 20, 2026 and Sep 28, 2026, about one every 2 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260928.af4f3a7 latest | 2026-09-28 | af4f3a7 | 9,357 B | A | view · diff |
| git:20260922.6233b3e | 2026-09-22 | 6233b3e | 8,952 B | A | view · diff |
| git:20260922.689beb7 | 2026-09-22 | 689beb7 | 8,833 B | A | view · diff |
| git:20260921.58c776a | 2026-09-21 | 58c776a | 6,211 B | A | view · diff |
| git:20260920.b1edfef | 2026-09-20 | b1edfef | 6,101 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9357 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cristallin2006/ghidra-skill-for-dsh · 11 stars · license MIT · pushed 2026-10-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_77r5qcym555ppqtz GET https://markdownregistry.com/api/v1/resolve?ref=cristallin2006/ghidra-skill-for-dsh/traffic-analysis GET https://markdownregistry.com/api/v1/blob/c7dac4d61ea1129bebc21e4e330f9b22928fd5605d5ca576ea069cf7663cb13d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from cristallin2006/ghidra-skill-for-dsh
Every file in cristallin2006/ghidra-skill-for-dsh