Skills protocol-reverse-engineering
📦

protocol-reverse-engineering

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Analyze Network Protocols Safely

Protocol behavior is hard to understand from raw packet captures. This skill gives structured methods to capture, dissect, document, and test network protocols.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "protocol-reverse-engineering" from https://skillstore.io/skills/sickn33-protocol-reverse-engineering.md and its manifest at https://skillstore.io/api/skills/sickn33-protocol-reverse-engineering/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-protocol-reverse-engineering.md Signed manifest GET /api/skills/sickn33-protocol-reverse-engineering/manifest Signed lockfile GET /api/skills/sickn33-protocol-reverse-engineering/lockfile

Test it

Using "protocol-reverse-engineering". A capture contains repeated TCP messages with a four-byte magic value, a version field, and changing payload lengths.

Expected outcome:

A protocol outline that names the fixed header, maps probable field offsets, lists message types, and highlights unknown fields for more captures.

Using "protocol-reverse-engineering". A team needs to analyze encrypted traffic from its own test browser session.

Expected outcome:

A safe workflow covering key log collection, restricted storage, Wireshark configuration, cleanup, and limits on production private key use.

Using "protocol-reverse-engineering". An implementation accepts custom binary messages and needs robustness testing in a lab.

Expected outcome:

A scoped test plan with authorized targets, replay cases, boundary values, fuzzing priorities, monitoring steps, and stop conditions.

Security Audit

High Risk
v6 • 7/9/2026 Open versioned report

Most static findings are documentation examples for packet filters, protocol signatures, Markdown paths, or binary protocol constants. Confirmed risks are sensitive TLS key material handling and dual-use interception, fuzzing, and replay guidance that needs clearer authorization and storage safeguards. No prompt injection evidence was found in the reviewed files.

2
Files scanned
540
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (2)

High
resources/implementation-playbook.md:319
Crypto seed/private key mention
# Decrypt with private key (if available)
The playbook advises TLS decryption with a private key if available. Private key handling is sensitive, and the section lacks warnings about production keys or file protection.
High
resources/implementation-playbook.md:43-56resources/implementation-playbook.md:432-485
Dual-use Traffic Interception and Active Testing Guidance
The playbook includes transparent MITM capture, TLS interception, target fuzzing, and packet replay or modification. These steps are legitimate in authorized labs, but can enable unauthorized interception or service disruption without clear guardrails.
The cited sections show mitmproxy transparent mode, ssl-insecure use, Boofuzz target fuzzing, and Scapy replay. No explicit authorization requirement appears in those sections.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
resources/implementation-playbook.md:313
Temp directory access
export SSLKEYLOGFILE=/tmp/keys.log
The example writes TLS pre-master secrets to /tmp/keys.log. This is a sensitive file in a shared temporary location, so it needs safer storage guidance.
Medium
resources/implementation-playbook.md:317
Temp directory access
# (Pre)-Master-Secret log filename: /tmp/keys.log
The Wireshark configuration example reuses /tmp/keys.log for TLS secrets. This is legitimate for analysis, but the temporary path can expose sensitive session material.

Risk Factors

🌐 Network access (4)
resources/implementation-playbook.md:66 resources/implementation-playbook.md:56 resources/implementation-playbook.md:67 resources/implementation-playbook.md:137
📁 Filesystem access (2)
resources/implementation-playbook.md:313 resources/implementation-playbook.md:317
⚙️ External commands (2)
SKILL.md:25 SKILL.md:29
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-protocol-reverse-engineering/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-protocol-reverse-engineering/security.svg)](https://skillstore.io/skills/sickn33-protocol-reverse-engineering?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-protocol-reverse-engineering?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-protocol-reverse-engineering/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-protocol-reverse-engineering.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). protocol-reverse-engineering security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-protocol-reverse-engineering/audits/6

BibTeX citation

@techreport{sickn33-sickn33-protocol-reverse-engineering-2026, author = {sickn33}, title = {protocol-reverse-engineering security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/sickn33-protocol-reverse-engineering/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "protocol-reverse-engineering security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-09" url: "https://skillstore.io/skills/sickn33-protocol-reverse-engineering/audits/6" identifiers: - type: other value: "skillstore:sickn33-protocol-reverse-engineering:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Document a Proprietary Protocol

Turn repeated packet captures into a clear message format, field map, and state machine.

Debug Client and Server Traffic

Use capture filters, stream following, and protocol signatures to find communication errors.

Validate Parser Behavior

Build controlled replay and fuzzing plans to test known protocol implementations.

Try These Prompts

Start a Capture Plan 
Help me plan an authorized packet capture for a client and server protocol. Include tools, filters, files to collect, and safety checks.
Identify Protocol Structure 
Review these observed packet patterns and infer likely message boundaries, headers, length fields, message types, and session identifiers.
Create a Protocol Specification 
Turn my protocol observations into a concise specification with transport, message format, state machine, examples, and open questions.
Design an Authorized Test Plan 
Design a lab-only fuzzing and replay plan for this protocol. Include scope limits, test cases, logging, rollback steps, and success criteria.

Best Practices

  • Get written authorization before capturing, intercepting, fuzzing, replaying, or modifying traffic.
  • Store captures, TLS key logs, and private keys in restricted locations and delete them when analysis ends.
  • Validate protocol assumptions with multiple captures before writing parsers, dissectors, or test cases.

Avoid

  • Do not intercept third-party traffic or production users without explicit permission.
  • Do not place TLS key logs or private keys in shared temporary folders.
  • Do not run fuzzing or replay tests against live services without an approved change window.

Frequently Asked Questions

What does this skill help analyze?
It helps analyze network protocols from packet captures, binary payloads, TLS metadata, and repeated client-server behavior.
Does it perform packet capture automatically?
No. It provides guidance and examples for tools such as Wireshark, tcpdump, tshark, Scapy, and mitmproxy.
Can it be used with Claude, Codex, and Claude Code?
Yes. The skill metadata declares support for Claude, Codex, and Claude Code.
Is it safe to use on any network?
No. Use it only on networks, systems, and traffic where you have clear legal authorization.
Can it decrypt TLS traffic?
It can explain approved TLS analysis methods, but decryption requires valid key material or key logs that you are allowed to use.
What should I prepare before using it?
Prepare the scope, authorization, sample captures, target protocol details, tool versions, and storage rules for sensitive files.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/protocol-reverse-engineering

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

8 downloads · 157 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md