How to use the Network Covert Channel Analyzer agent skill

What does the skill make the agent do?

An agent skill is a folder of instructions and scripts that an AI agent can load when a task matches its description. This one gives the agent a structured procedure for examining packet capture files (PCAPs) to find covert communication channels used by malware.

The source describes three main channel types: DNS tunneling, which encodes data in DNS queries and responses; ICMP tunneling, which hides data in echo request and reply payloads; and HTTP covert channels, which embed data in headers, cookies or images. The skill's example code scores DNS domains using long subdomains, high uniqueness, high subdomain entropy and many TXT queries, then flags domains that reach a score of 50 or more. For ICMP, it flags flows with large average payloads or many packets.

• Scores suspicious domains using average subdomain length above 30 characters, unique subdomain ratio above 0.9, subdomain entropy above 4.0 and more than 10 TXT queries.
• Flags ICMP flows with average payload above 64 bytes or more than 100 packets.
• Validates results by separating likely tunneling from legitimate CDN and cloud traffic.
• Estimates exfiltration volume and extracts beaconing intervals where the procedure covers them.

Install the skill from the ZIP download

Download the skill ZIP from this page and unzip it. You can install it for yourself or for a single project.

For a personal install, place the unzipped skill folder in your ~/.claude/skills/ directory. For a project-only install, place it in the .claude/skills/ directory inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Know what you need before you start

The skill's prerequisites list Python 3.9 or newer, the scapy library (required by the bundled script and the examples), and dpkt and dnslib. Wireshark or tshark and Zeek are listed as optional tools. You also need a PCAP file to analyze.

The skill does not use the network, but it does run scripts, so run it in an environment where you are comfortable executing Python code.

• Python 3.9+
• scapy (required)
• dpkt and dnslib (listed in prerequisites)
• Wireshark/tshark and Zeek (optional)
• A PCAP file to analyze

Trigger the skill with natural requests

You do not need to name the skill. Agents load a skill when your request matches its description, which covers investigating suspicious DNS, ICMP or HTTP traffic, hunting for hidden C2 channels in captures, and attributing exfiltration traffic to a known tunneling toolset.

Be specific about the capture and the question. Mention the PCAP file, the protocol you suspect and what you need back, such as a ranked list of domains with reasons.

• Review capture.pcap for DNS tunneling and rank the suspicious domains by score.
• Check this PCAP for ICMP payloads that look like data exfiltration.
• Hunt for hidden C2 in this network capture and explain each finding.
• Does this traffic show signs of tunneling with tools like iodine or dnscat2?

Read the results with care

The heuristics produce candidates, not confirmed attacks. Legitimate traffic such as CDN or antivirus lookups can score highly, so every finding needs a human to review it against context such as known good domains and host ownership.

The skill analyzes captures only. It is not a remediation tool and does not contain steps to block or clean up live malware. Captures can contain full packet contents, so only analyze data you are authorized to examine.

• Treat scores as triage priorities, not verdicts.
• Check high-scoring domains against known CDN and cloud services before escalating.
• Use the report template in the skill's assets to record findings, IOCs and recommendations.