Competition PCAP Protocol
Guides an agent through analyzing packet captures: rebuilding sessions and decoding protocols and transferred files.
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 3 files
What it does
This is a specialist instruction set for an AI agent working on packet capture (PCAP) files, the recordings of network traffic. It tells the agent to first set capture boundaries, group packets into TCP/UDP sessions, decode protocol framing (such as HTTP, DNS, WebSocket or custom binary protocols), recover transferred files, and only then link the traffic to host or malware behaviour. It is written as a downstream step for a CTF (capture-the-flag) sandbox workflow and is meant to be used after a parent skill has set up that context.
Great for
- Students or competitors working on CTF challenges that involve network captures
- Security analysts who need to reconstruct sessions and extract artifacts from a sandboxed PCAP
- Developers reverse-engineering a custom binary or C2-style protocol from captured traffic
Skip it if
- Live production networks or real third-party traffic without authorization, since the skill is aimed at analysing captures in a controlled sandbox
- Simple single-indicator or host-log investigations, which the SKILL.md itself says belong to a different forensic timeline skill
- Users who expect it to run standalone: it depends on the parent $ctf-sandbox-orchestrator skill and companion skills that are not included in these files
Try asking
- “Analyze this PCAP and rebuild the TCP sessions, listing endpoints, ports and stream IDs.”
- “Decode the custom binary protocol in this capture and recover any files that were transferred.”
- “Show which packet sequence corresponds to the login flow and the command channel in this sandbox capture.”
- “Check this capture for beacon timing patterns and correlate them with the process activity.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the MIT licence and an attribution note.
competition-pcap-protocol.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip competition-pcap-protocol.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip competition-pcap-protocol.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Load the capture into the sandbox first and state the time span and hosts so the agent can set boundaries before decoding.
- Expect replies in Simplified Chinese by default; ask explicitly for English if you need it.
- Install the referenced companion skills (competition-websocket-runtime, competition-custom-protocol-replay) if your challenge involves WebSocket or custom handshakes, since the skill points to them.
What's inside
- agents/openai.yaml
- references/pcap-protocol.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.