PCAP Analyzer

Analyze local PCAP/PCAPNG files with tshark to generate detailed network forensics reports including talkers, ports, DNS, TLS, HTTP, and anomaly summaries.

Security Scan

The skill's stated purpose (local tshark-based PCAP analysis) matches the included analyzer script, but there are incoherent and risky elements — namely a hard-coded external script path in skill.yaml and SKILL.md metadata that don't align with the shipped files or declared requirements.

Purpose & Capability

The skill claims local PCAP analysis with tshark, which matches the included scripts. However SKILL.md metadata and skill.yaml reference /home/tom/openclaw-tools/pcap_summary.sh (an external user-specific path) while the bundle actually contains scripts/analyze.sh. The registry metadata lists no required binaries, but SKILL.md lists tshark, awk, sed — a mismatch. The hard-coded external path is not justified by the stated purpose and is unexpected for a portable skill.

Instruction Scope

scripts/analyze.sh operates locally and only reads the user-provided PCAP, which is coherent. But skill.yaml's command runs /home/tom/openclaw-tools/pcap_summary.sh directly (outside the skill bundle). SKILL.md also lists that external file as a preferred summarizer. That gives the skill the capability to execute arbitrary code outside the shipped files if that external script exists; SKILL.md's claim 'does not exfiltrate the PCAP' is plausible for the included script but cannot be guaranteed for the external /home/tom script.

Install Mechanism

There is no install spec; this is instruction-only plus a small helper script in the bundle. No downloads or extraction are requested, which is low risk for installation. The only risk is runtime execution of an external path if present.

Credentials

The skill declares no required environment variables or credentials, which is appropriate. However SKILL.md metadata requires external files at /home/tom/openclaw-tools/pcap_summary.sh — effectively a config path requirement not declared in the registry. That path could reference an unexpected script and grants the skill ability to run code outside the bundle; this is disproportionate to a portable PCAP analyzer.

Persistence & Privilege

The skill does not request persistent/always-enabled privileges (always: false) and does not attempt to modify other skills or system-wide settings. Default autonomous invocation is allowed (platform default) but does not combine with other escalated privileges here.

What to consider before installing

This skill mostly does what it says (local tshark-based PCAP summarization), but it has a notable misconfiguration: skill.yaml and SKILL.md prefer/require /home/tom/openclaw-tools/pcap_summary.sh — a hard-coded, user-specific path outside the skill. That means if that file exists on your system it will be executed instead of the bundled script, and you should not assume it behaves safely. Before installing or running: (1) inspect /home/tom/openclaw-tools/pcap_summary.sh if it exists on your machine and ensure you trust it; (2) prefer running the bundled scripts/analyze.sh manually to confirm behavior; (3) ensure tshark (and awk/sed) are installed and run tests on non-sensitive PCAPs first; (4) ask the publisher to fix skill.yaml to call the bundled script (not a hard-coded home path) and to declare required binaries; (5) avoid running as root and avoid providing PCAPs that contain secrets until you’ve verified the tool’s behavior. The inconsistencies could be an innocent packaging error — but treat it as suspicious until corrected.

name: pcap-analyzer description: Analyze PCAP/PCAPNG files with tshark and produce a structured network-forensics summary (talkers, ports, DNS, TLS, HTTP, anomalies). homepage: https://www.wireshark.org/docs/man-pages/tshark.html metadata: { "openclaw": { "emoji": "🦈", "requires": { "bins": ["tshark", "awk", "sed"], "files": ["/home/tom/openclaw-tools/pcap_summary.sh"] }, "notes": [ "This skill runs local analysis only. It does not exfiltrate the PCAP.", "Prefer read-only access; do not modify user files." ] } }

PCAP Analyzer (tshark)

This skill turns packet captures into a practical report a human can act on. It is designed for lab work, incident triage, and CPENT-style exercises.

What it produces

A structured report with:

• Capture metadata: file type, size, first/last timestamp (if available)
• Top talkers: endpoints by packets/bytes (IPv4/IPv6 when present)
• Conversations: top TCP/UDP conversations
• Service/port view: top TCP/UDP destination ports
• DNS: most common queried names + suspicious patterns (DGA-ish, long labels)
• TLS: SNI / Server Name and common JA3-like fingerprints when present (best-effort)
• HTTP: host headers / URLs when present (best-effort, only if decrypted/plain)
• Anomalies (best-effort heuristics):
  • SYN-only scans / high SYN rate
  • excessive RSTs
  • retransmission bursts
  • rare destination ports
  • single host contacting many unique hosts (beaconing-like)

Inputs

You must provide:

• pcap_path: Full path to a .pcap or .pcapng file on this machine.

Optional:

• focus_host: IP to focus on (filters summaries around that host)
• time_window: A display filter time window if user specifies (best-effort guidance only)

How to run (terminal)

{baseDir}/scripts/analyze.sh "/full/path/to/capture.pcapng"