Skill

performing-network-forensics-with-wireshark

skill:mukul975/anthropic-cybersecurity-skills#performing-network-forensics-with-wireshark

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:52 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

63/66

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-network-forensics-with-wireshark:skills/performing-network-forensics-with-wireshark/SKILL.md:200:EXEC
suspicious: finding skill:skills/performing-network-forensics-with-wireshark:skills/performing-network-forensics-with-wireshark/SKILL.md:200:SUPPLY

Security findings 2

Code execution

highContextual risklow confidence

Step 5 instructs the agent to download an unpinned NetworkMiner zip from the mutable vendor URL www.netresec.com, unpack it into /opt, and execute the binary with mono after installing mono-complete via sudo, forming a download-and-execute chain whose payload is whatever the URL serves at run time.

skills/performing-network-forensics-with-wireshark/SKILL.md:200-205

wget https://www.netresec.com/?download=NetworkMiner -O NetworkMiner.zip

vector:instruction

Counter-argument considered

Strongest counter-case is the vendor-installer carve-out, but the download is not pinned to any version or hash, sits in the agent-executed workflow rather than a fenced install doc, and NetworkMiner is outside the declared Wireshark/tshark capability; the mutable-URL download followed by mono execution of whatever is served, plus undeclared sudo mono-complete install, is a real download-and-execute chain.

Supply chain

mediumContextual riskmedium confidence

Step 5 of SKILL.md instructs the agent to download the NetworkMiner executable from an unpinned vendor URL and run it with mono, executing whatever binary the remote site serves at run time.

skills/performing-network-forensics-with-wireshark/SKILL.md:200-205

wget https://www.netresec.com/?download=NetworkMiner -O NetworkMiner.zip

vector:instruction

Counter-argument considered

Same unit as the EXEC finding: the unpinned, unversioned vendor URL serves whatever binary is current at run time and the skill instructs the agent to execute it with mono; it is not a pinned official-registry install and not a vendor installer in a fenced install doc, so the supply-chain finding survives.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

Step 4 of SKILL.md instructs tshark to extract plaintext FTP usernames, passwords, and HTTP authorization headers from the captured traffic, materializing real credentials on the analyst host.

skills/performing-network-forensics-with-wireshark/SKILL.md:186-193

# Extract credentials from unencrypted protocols

Why it was refuted

Extracting FTP USER/PASS and HTTP authorization headers from the analyst's own captured PCAP is precisely the skill's declared core capability ('extract transferred files and credentials' from PCAP/PCAPNG), so the declared-core-capability carve-out kills the harm gate; the behavior is openly labeled, purely local tshark field extraction with no network sink, and the declared description covers it so it is neither undeclared nor concealed.

Code execution

criticalRefutedlow confidence

The skill's Step 1 instructs the agent to run a root-privileged package installation (sudo apt-get install wireshark tshark) as a prerequisite before any analysis, an auto-run setup step executed with elevated privileges, though the packages are the skill's declared core tools from official apt repositories.

skills/performing-network-forensics-with-wireshark/SKILL.md:51

sudo apt-get install wireshark tshark

Why it was refuted

The command installs exactly the two tools named in the skill's declared description from official distro repositories, openly labeled '# Install Wireshark and tshark', making it a disclosed prerequisite of the declared core capability rather than harm; the sudo element is 'broad permissions alone', a carve-out, and the detector's residue flag is outweighed by the declared description naming Wireshark and tshark as the skill's tools.

Coverage gaps 7

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:75840b039e68baad

ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:75840b039e68baad

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:75840b039e68baad

invalid_judge_finding instruction-surface.0

invalid_judge_finding declared-vs-actual.0

invalid_judge_finding behavior-chains.0

invalid_judge_finding request.0