Guide · Agent skill
How to use the Protocol Reverse Engineering agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The protocol-reverse-engineering skill is a set of instructions that teaches an AI agent the standard workflow for studying network traffic. Once it is installed, the agent can walk you through capturing packets, filtering and extracting fields, recognising common protocol headers, and writing up the structure of an undocumented protocol. This guide covers what the skill does, how to install it, how to ask for it, and the safety limits you need to respect.
Protocol Reverse Engineeringwshobson/agents · MIT Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it so the folder is named protocol-reverse-engineering and contains SKILL.md.
- 2Place the skill. Put the folder in ~/.claude/skills/ for all projects, in a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the required tools. Install Wireshark and tshark, tcpdump, mitmproxy, and Python with Scapy and Boofuzz if you need them. Burp Suite is needed only for HTTP interception.
- 4Make a request in plain language. Describe the traffic task, the capture file and the device or service involved, for example a pcap you want analysed.
- 5Capture and verify ownership. Capture only traffic you are authorised to monitor, and review each command the agent gives before running it.
- 6Document what you learn. Ask the agent to map header fields and write a specification, then validate it by building a parser against your samples.
What the skill makes the agent do
The skill covers packet analysis, protocol dissection and documenting custom protocols. Its source describes capture with Wireshark, tshark, tcpdump and mitmproxy, analysis with display filters and Scapy, and identification of signatures such as HTTP, TLS, DNS, SSH and Redis.
It also covers basic active testing: replaying captured traffic and fuzzing a test service with Boofuzz. The skill guides an agent that runs command-line tools, so the agent gives you commands and analysis steps rather than acting as a point-and-click application.
- Capture traffic with Wireshark, tshark, tcpdump, mitmproxy or Burp Suite
- Filter, follow streams and extract fields from pcap files
- Recognise common protocol signatures and header layouts
- Write a protocol specification and a parser
- Replay or fuzz traffic against a service you are authorised to test
How to install the skill
Download the ZIP from this page. Unzip it into ~/.claude/skills/ to make the skill available to all your projects, or into a project's .claude/skills/ folder to limit it to that project. The folder should be named protocol-reverse-engineering and contain SKILL.md.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
How to trigger the skill with natural requests
You do not need a special command. The skill's description says it applies when you are analysing network traffic, understanding proprietary protocols or debugging network communication, so describe that task in plain language.
Name the file, interface or service you are working with. The more specific the request, the more precise the commands will be.
- 'I have a pcap of my device talking to its cloud service. Help me find the message boundaries.'
- 'Show me a tshark command that lists the TCP conversations in capture.pcap.'
- 'Help me write a parser for the header in this packet dump.'
- 'Draft a specification for this protocol I captured from my own test device.'
Capture and analyse traffic with the skill's commands
For capture, the skill gives commands such as a tcpdump capture filtered to a port, which writes to a file you can analyse later. For analysis, it covers tshark statistics and field extraction, and Wireshark display filters such as tcp.port == 8080.
The skill also describes a workflow: capture several sessions under different scenarios, identify message boundaries, map fixed headers and variable payloads, compare samples to find fields, then document and validate the format.
- Capture several sessions in different scenarios, not just one
- Compare multiple samples to find which bytes change
- Look for magic numbers, length fields, type or opcode fields and sequence numbers
- Check for checksums, timestamps and session identifiers
tcpdump -i eth0 port 8080 -w capture.pcapSafety: what it needs and what to avoid
The skill runs scripts and uses the network, so review what the agent proposes before you run it. Capture and interception only belong on networks and devices you own or have permission to monitor. Monitoring other people's traffic may be illegal.
Replaying or fuzzing should target a test service. Fuzzing production or third-party systems can cause outages or legal trouble.
- Requires Wireshark and tshark, tcpdump, mitmproxy and Burp Suite (for HTTP interception), and Python with Scapy and Boofuzz
- Only capture or intercept traffic you are authorised to monitor
- Fuzz only a test service you control, never production systems
- Read commands before running them, especially ones that send packets
Tips for better results
Give the agent real captures and context about the device or app, since the skill's techniques depend on comparing samples. Ask for one step at a time when you are unsure of the protocol.
The skill loads extra reference files for binary and encryption analysis and for writing specifications, so mention those topics explicitly when they apply.
- Start with a short capture of a single action
- Tell the agent which tools you have installed
- Ask for a specification template when documenting a protocol
What people use it for
- Debugging how your own app or device talks over the network
- Analysing a proprietary protocol you are authorised to test
- Writing a parser or interoperable client for an existing protocol
- Documenting the header and message types of a custom protocol
Frequently asked questions
How do I install the protocol reverse engineering skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills. The folder should contain SKILL.md.
What do I need to use the protocol-reverse-engineering skill?
The skill's source lists Wireshark and tshark, tcpdump, mitmproxy and Burp Suite for HTTP interception, plus Python with Scapy and Boofuzz. It runs scripts and uses the network, so the agent needs access to these tools on your machine.
Is the protocol reverse engineering skill free?
The skill is published under the MIT licence, as listed on this page. The tools it refers to, such as Wireshark and mitmproxy, have their own licences that you should check separately.
Can I use this skill to intercept traffic on any network?
No. Capturing or intercepting traffic on networks or devices you do not own or have permission to monitor may be illegal. Use it only where you are authorised, and fuzz only test services you control.
What are alternatives to this skill?
You can use Wireshark, tcpdump or mitmproxy directly without an agent. This skill is different because it guides an AI agent through the same workflow and commands, so you get step-by-step guidance instead of general answers.
Why isn't my agent using the skill?
Check that the folder is named protocol-reverse-engineering and that SKILL.md is inside it, in the location you chose. Then describe a network traffic task in plain language, since the skill applies to analysing traffic, proprietary protocols and network debugging.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a developer debugging your own app or device, a researcher analysing a protocol you are authorised to test, or an engineer writing a parser for an existing protocol. Pick something else if you want a point-and-click tool or you need to monitor traffic you have no permission to inspect.
Download the skill