packet-capture-analysis SKILL.md skillA
packet-capture-analysis from aktsmm/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add aktsmm/agent-skills/packet-capture-analysis@git:20261004.e1c4ed1Pins git:20261004.e1c4ed1 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- aktsmm/agent-skills
- Path
packet-capture-analysis/SKILL.md- Versions recorded
- 3
- Latest version
- git:20261004.e1c4ed1, committed Oct 4, 2026
- First version recorded
- Jul 5, 2026
- Size
- 6,672 bytes
- Repository stars
- 26
- License
- a license file GitHub does not identify
Use when analyzing pcap or pcapng files, triaging network captures, labeling IPs with evidence, generating PNG charts, or writing packet analysis reports. Keywords: pcap, pcapng, tshark, Wireshark, scapy, DNS, TLS SNI, RDAP, graph, matplotlib, gnuplot, packet capture.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Packet Capture Analysis pcap / pcapng を読んで、全体像の把握、IP の意味付け、PNG 可視化、Markdown レポート化まで進めるための skill。 ## When To Use - `pcap` や `pcapng` を渡されて、まず何が起きているか把握したいとき - 主要通信先、主要会話、プロトコル構成を短時間で掴みたいとき - DNS、HTTP Host、TLS SNI、RDAP を使って IP に根拠付きラベルを付けたいとき - PNG グラフや Markdown レポートまで一緒に作りたいとき - 暗号化通信が多く、本文ではなく行動特性から説明したいとき - セキュリティ調査と運用調査のどちらにも使いたいとき ## Core Principles - **まずキャプチャ品質を見る**。snaplen、時系列、件数、期間に問題があれば結論の強さを下げる。 - **最初の 3 手は固定**。`Protocol Hierarchy` → `Endpoints` → `Conversations` で全体像を作る。 - **IP は生のまま並べない**。`HTTP Host -> DNS 応答 -> TLS SNI / gQUIC SNI -> RDAP -> reverse DNS` の順で意味付けする。 - **証拠源は混ぜない**。`hostname` と `organization` のような別種の根拠は分けて持つ。 - **Expert Information は入口であって結論ではない**。前後の会話量、方向、再送、再組立てを見直す。 - **暗号化通信は本文ではなく行動特性で説明する**。相手先、方向、量、時間帯、継続時間で語る。 - **一次集計は CLI、派生集計は Python**。`capinfos` / `tshark` で切ってから `scapy` / `matplotlib` へ渡す。 ## Default Workflow 1. **調査目的を固定する** - 何を知りたいのかを先に決める。 - 例: 大容量通信の相手、怪しい外部送信、特定アプリ通信、レポート化。 2. **キャプチャ品質を確認する** - 期間、件数、平均レート、時系列、snaplen、`pcapng` の名前解決情報を確認する。 - 品質に問題があるなら、その後の結論は「傾向把握寄り」に落とす。 3. **全体像を作る** - `Protocol Hierarchy` / `Endpoints` / `Conversations` でベースラインを作る。 - ここでは細部に潜りすぎず、支配的プロトコル、主要通信先、主要会話を押さえる。 …
Read the whole file at its exact version.
How to install
mdr add aktsmm/agent-skills/packet-capture-analysis@sha256:04b7cb6cc8ffe3bfThe line at the top of this page pins the label git:20261004.e1c4ed1, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_lxndqldxmc26cb4x)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Jul 5, 2026 and Oct 4, 2026, about one every 45 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261004.e1c4ed1 latest | 2026-10-04 | e1c4ed1 | 6,672 B | A | view · diff |
| git:20260709.e6b8215 | 2026-07-09 | e6b8215 | 6,632 B | A | view · diff |
| git:20260705.848fd9b | 2026-07-05 | 848fd9b | 7,136 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6672 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
aktsmm/agent-skills · 26 stars · license a license file GitHub does not identify · pushed 2026-11-04 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_lxndqldxmc26cb4x GET https://markdownregistry.com/api/v1/resolve?ref=aktsmm/agent-skills/packet-capture-analysis GET https://markdownregistry.com/api/v1/blob/04b7cb6cc8ffe3bf93093206f34d8a6e12dbc4c767962999818166878628f8f9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.