Skill

performing-network-traffic-analysis-with-zeek

skill:mukul975/anthropic-cybersecurity-skills#performing-network-traffic-analysis-with-zeek

Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:19 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

97/97

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-network-traffic-analysis-with-zeek:skills/performing-network-traffic-analysis-with-zeek/SKILL.md:98:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill's installation instructions direct the agent to add a third-party apt repository over plain HTTP to /etc/apt/sources.list.d/zeek.list via sudo tee and to install unpinned Zeek packages non-interactively (apt-get -y), pulling executable code from a remote mutable source during setup.

skills/performing-network-traffic-analysis-with-zeek/SKILL.md:98

deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /

vector:instruction

Counter-argument considered

The strongest refutation case (this is merely the standard way to deploy the declared tool, Zeek, so it falls under the core capability) fails because the carve-out for installs is limited to pinned official-registry installs, while this instruction adds a third-party openSUSE-hosted apt repo over plain HTTP and installs unpinned packages non-interactively, with no signing-key step or any mitigation, and the artifact declares no claims covering this network source. The instruction is concrete, reachable, and undeclared, so the finding stands at its stated low, contextual severity.