How to use the Competition PCAP Protocol agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder containing a SKILL.md file and supporting reference files. When a request matches the skill's description, the agent loads these instructions and follows them for that task.

This skill, competition-pcap-protocol, makes the agent work through a capture in a fixed order: first set the capture boundaries (hosts, time span, interfaces, missing packets, retransmits and stream count), then group packets into TCP or UDP sessions, then decode protocol framing, and only after the session is reconstructed link the traffic to host or malware behaviour. It stresses that naming a protocol such as HTTP or DNS is not enough without decoded content or a proven downstream effect.

• Identifies endpoints, protocols, ports, TLS handshakes, DNS lookups, WebSocket upgrades and long-lived streams.
• Reassembles TCP streams or UDP conversations before interpreting fields.
• Recovers framing, message order, binary fields, compression, encryption boundaries and transferred objects.
• Keeps stream IDs, endpoint pairs, packet ranges, timestamps and object boundaries together as evidence.

Install the competition-pcap-protocol skill

Download the ZIP from the skill's page on this directory, then use one of the two methods below.

For Claude Code, unzip the folder into your personal skills directory ~/.claude/skills/, or into a project's .claude/skills/ directory if you want it limited to one project. For the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

Note that this skill is a downstream skill. It is designed to be used alongside the parent ctf-sandbox-orchestrator skill and companion skills, which are not included in the files here.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language using the kinds of work the description covers: analysing a PCAP, rebuilding TCP or UDP sessions, decoding HTTP, WebSocket, DNS, custom C2 or binary protocols, extracting transferred artifacts, or tying packets to host or malware behaviour.

The skill's own text says it should only be used after $ctf-sandbox-orchestrator has already set sandbox assumptions and routed the work here. If that parent skill has not run, the agent is instructed to return to it first, so start your session with that context.

• Analyze this PCAP and tell me how many TCP streams it contains.
• Rebuild the HTTP sessions in this capture and extract any files that were downloaded.
• Decode the DNS lookups and tell me which ones look like beacon timing.
• Reverse the custom binary protocol on port 4444 from this sandbox capture.

What output should you expect?

The skill asks the agent to keep evidence together rather than as isolated packets. A good answer names the stream ID, endpoint pair, packet range and timestamps, shows the decoded framing or messages, and states the exact packet sequence or reconstructed stream that supports each conclusion.

The skill also says to reply in Simplified Chinese unless you explicitly ask for English, so request English in your message if you need it.

• Session identity: endpoints, ports, protocol, stream ID and timestamps.
• Decode facts: framing markers, lengths, message order, headers or object names.
• Behavioural link: the command, transfer or beacon path the decoded stream supports.

What do you need before you start?

The skill's metadata lists no required dependencies, does not run scripts and does not use the network. It is a set of instructions for the agent, so the practical requirement is an agent environment that can load skills and read the capture file you give it.

The skill is not standalone. It expects the parent ctf-sandbox-orchestrator skill to be active, and it points to companion skills (competition-websocket-runtime and competition-custom-protocol-replay) for WebSocket and custom-protocol replay work. Those companions are not included in these files.

• No listed dependencies and no scripts run by the skill.
• Parent skill: $ctf-sandbox-orchestrator must already be active.
• Companion skills, when the task calls for them: $competition-websocket-runtime, $competition-custom-protocol-replay.

Safety notes: scripts, network and authorization

The skill is aimed at analysing captures inside a controlled sandbox. It is not meant for live production networks or for real third-party traffic you are not authorised to analyse.

The skill itself runs no scripts and uses no network access. Any scripts or network activity would come from the agent environment and other skills you install, so review those separately.

• Use it on captures from a controlled sandbox or challenge files you are allowed to analyse.
• Do not use it on live production traffic or third-party traffic without authorisation.
• For simple single-indicator or host-log investigations, use a different forensic timeline skill, as the SKILL.md directs.

Tips for better results

Give the agent the context the parent skill expects: which hosts are in scope, the capture's time span and any known gaps. The skill asks for missing packets, retransmits and asymmetric routing to be noted before conclusions are drawn, so mention them if you know about them.

Ask for the smallest decoded stream or transferred artifact that proves the behaviour, rather than a full dump. If the hard part is a WebSocket handshake or a custom checksum, say so, since the skill points to its companion skills for those cases.

• State known capture gaps up front.
• Ask for stream IDs and packet ranges alongside every finding.
• Name the protocol you suspect, but expect the agent to show decoded content to support it.