技能 analysis-tshark

📦

analysis-tshark

Name: analysis-tshark
Author: AgentSecOps

v0.1.0 內容修訂 r2 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數⚡ 包含腳本

使用 TShark 分析網路流量

封包擷取資料可能藏有資安事件、外洩的憑證與異常流量模式。此技能會引導經授權的 TShark 擷取、篩選、萃取與報告工作流程。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "analysis-tshark" from https://skillstore.io/skills/agentsecops-analysis-tshark.md and its manifest at https://skillstore.io/api/skills/agentsecops-analysis-tshark/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/agentsecops-analysis-tshark.md 已簽名 manifest GET /api/skills/agentsecops-analysis-tshark/manifest 已簽名 lockfile GET /api/skills/agentsecops-analysis-tshark/lockfile

測試它

正在使用「analysis-tshark」。來自疑似工作站遭入侵的 pcap。

預期結果:

通訊協定摘要、主要對話、DNS 與 HTTP 指標、可疑傳輸備註，以及建議的下一步分級處理措施。

正在使用「analysis-tshark」。要求在五分鐘事件時段內擷取流量。

預期結果:

一份限定範圍的擷取計畫，包含介面檢查、擷取篩選器、持續時間限制、儲存控制與清理指引。

正在使用「analysis-tshark」。需要在舊式通訊協定流量中尋找明文憑證。

預期結果:

一份受控檢閱計畫，列出通訊協定篩選器、機密資料處理規則，以及報告的遮罩要求。

安全審計

嚴重

v9 • 2026/7/23 開啟版本化報告

Most static alerts are false positives caused by Markdown formatting, defensive examples, offline packet filters, and framework terminology. Confirmed risks include remote pipe-to-shell installation, mutable third-party token exposure, privileged packet capture, and TLS key handling. Credential extraction and packet-metadata email alerts add sensitive-data exposure.

已掃描檔案

2,168

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (5)

嚴重

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The CI template downloads a script from a mutable upstream branch and pipes it directly to bash. A compromised repository or changed script would gain code execution in the CI runner.

高

SKILL.md:608

Certificate/key files

tshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y "http"

The command consumes a TLS key-log file to decrypt captured traffic. Key-log files contain session secrets and require strict access, retention, and deletion controls.

高

SKILL.md:611

Certificate/key files

tshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,/path/to/server.key

The command directs TShark to read a server private-key file for traffic decryption. Private-key access is highly sensitive and can expose protected sessions if mishandled.

高

SKILL.md:275-320 SKILL.md:473-487

Credential and Authentication Artifact Extraction

The guide instructs users to extract plaintext credentials, NTLM responses, HTTP POST bodies, and authentication data from captures. These dual-use workflows can expose reusable secrets and personal data if authorization or storage controls fail.

The cited sections explicitly provide commands for credential extraction and writing POST data or NTLM responses to local files.

中

SKILL.md:550-555

Packet Metadata Disclosure Through Email Alerts

The monitoring example emails packet-derived source, destination, host, and DNS data to a configured mailbox. This can disclose monitored network metadata through an external mail path.

The script pipes each TShark alert line into the mail command, and the selected fields include internal addresses, HTTP hosts, and DNS names.

能力複核項目 (32)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

This URL retrieves executable installation code from a mutable upstream branch. The network dependency directly supports the unsafe pipe-to-shell command on the same line.

高

assets/ci-config-template.yml:164

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow exposes GITHUB_TOKEN to a third-party action referenced by a mutable version tag. Compromise of that action could disclose or misuse the job token within its granted permissions.

高

SKILL.md:38

sudo privilege escalation

sudo tshark -i eth0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:41

sudo privilege escalation

sudo tshark -i eth0 -c 100 -w capture.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:87

sudo privilege escalation

sudo tshark -D

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:90

sudo privilege escalation

sudo tshark -i eth0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:91

sudo privilege escalation

sudo tshark -i wlan0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:94

sudo privilege escalation

sudo tshark -i any

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:97

sudo privilege escalation

sudo tshark -i eth0 -i wlan0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:113

sudo privilege escalation

sudo tshark -i eth0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:116

sudo privilege escalation

sudo tshark -i eth0 -c 1000

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:119

sudo privilege escalation

sudo tshark -i eth0 -a duration:60

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:122

sudo privilege escalation

sudo tshark -i eth0 -w capture.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:125

sudo privilege escalation

sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:141

sudo privilege escalation

sudo tshark -i eth0 -f "tcp port 80"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:144

sudo privilege escalation

sudo tshark -i eth0 -f "host 192.168.1.100"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:147

sudo privilege escalation

sudo tshark -i eth0 -f "net 192.168.1.0/24"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:150

sudo privilege escalation

sudo tshark -i eth0 -f "tcp port 80 or tcp port 443"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:153

sudo privilege escalation

sudo tshark -i eth0 -f "not port 22"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:156

sudo privilege escalation

sudo tshark -i eth0 -f "tcp[tcpflags] & tcp-syn != 0"

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:441

sudo privilege escalation

sudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:458

sudo privilege escalation

sudo tshark -i eth0 -w malware_traffic.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:477

sudo privilege escalation

sudo tshark -i eth0 -Y "(http.authorization or ftp or pop or imap) and not tls" -T fields -e ip.src

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:509

sudo privilege escalation

sudo tshark -i mon0 -w wireless_capture.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:550

sudo privilege escalation

sudo tshark -i $INTERFACE -Y "$ALERT_FILTER" -T fields -e frame.time -e ip.src -e ip.dst -e http.hos

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:565

sudo privilege escalation

sudo tshark -i eth0

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:568

sudo privilege escalation

sudo usermod -a -G wireshark $USER

This command uses sudo to persistently add the current user to the wireshark group. That expands packet-capture access beyond the current session and requires explicit administrator approval.

高

SKILL.md:569

sudo privilege escalation

sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/tshark

This command uses sudo to grant TShark raw-network and network-administration capabilities. Those persistent capabilities permit sensitive packet capture without future sudo prompts.

高

SKILL.md:582

sudo privilege escalation

sudo tshark -D

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:594

sudo privilege escalation

sudo tshark -i eth0 -f "not port 22" -w capture.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:597

sudo privilege escalation

sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

高

SKILL.md:600

sudo privilege escalation

sudo tshark -i eth0 -s 128 -w capture.pcap

This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

風險因素

⚙️ 外部命令 (50)

🌐 網路存取 (37)

📁 檔案系統存取 (2)

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

🔑 環境變數 (23)

⚡ 包含腳本 (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

偵測到的模式

Pipe to shell pattern

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-analysis-tshark/security.svg)](https://skillstore.io/skills/agentsecops-analysis-tshark?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/agentsecops-analysis-tshark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-analysis-tshark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/agentsecops-analysis-tshark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

AgentSecOps. (2026). analysis-tshark security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9

BibTeX 引用

@techreport{agentsecops-agentsecops-analysis-tshark-2026,
  author = {AgentSecOps},
  title = {analysis-tshark security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "analysis-tshark security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-analysis-tshark:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

調查進行中的事件

擷取短時間且範圍明確的流量時段，並萃取指標以進行分級處理與圍堵。

檢閱鑑識封包擷取檔

在事件後分析期間，依通訊協定、憑證、payload 與時間軸篩選 pcap。

驗證網路控制措施

檢查加密、網路分段與監控控制措施是否暴露敏感流量。

試試這些提示

檢查擷取檔

使用 analysis-tshark 檢查此 pcap。摘要說明通訊協定、主要對話、DNS 名稱、HTTP hosts，以及任何明顯的敏感資料。

建立安全的擷取指令

為經授權的事件時段建立一份簡短的 TShark 擷取計畫。包含篩選器、持續時間、輸出命名與資料處理步驟。

萃取事件指標

分析此擷取資料中的 beaconing、可疑 DNS、可執行檔下載、異常 POST 流量與候選 IOCs。解釋每個篩選器。

準備鑑識發現

設計一套可重複執行的 TShark 工作流程，用於監管鏈分析。包含成品萃取、遮罩、驗證，以及精簡的發現報告。

最佳實務

在任何即時封包擷取前，確認書面授權、範圍、留存與隱私要求。
可行時先從離線 pcap 分析開始，並透過篩選器、持續時間與封包大小限制即時擷取。
加密擷取檔、限制存取、遮罩敏感欄位，並記錄監管鏈。

避免

在沒有明確事件範圍或留存計畫的情況下擷取大範圍正式環境流量。
將萃取出的憑證、TLS 金鑰或封包 payload 儲存在共享或未加密的位置。
從未經審查的 prompt 執行特權擷取指令，或在你未管理的網路上執行這些指令。

常見問題

此技能是否需要安裝 TShark？

是。此技能說明 TShark 工作流程，並假設本機環境已具備 TShark 或 Wireshark 工具。

它可以分析既有的擷取檔嗎？

可以。許多工作流程使用離線 pcap 檔案，不需要即時封包擷取。

它可以擷取即時網路流量嗎？

可以，但僅限於有明確授權與適當處理控制的情況。即時擷取可能暴露私人資料。

它會自動解密 TLS 流量嗎？

不會。TLS 解密需要經核准的金鑰材料、相容的工作階段，並且必須謹慎保護任何金鑰檔案。

此技能適合用於攻擊性工作嗎？

它具有雙重用途。Marketplace 使用者應僅將其用於經授權的安全營運、鑑識與合規工作。

Claude、Codex 或 Claude Code 可以使用此技能嗎？

可以。報告列出對 Claude、Codex 與 Claude Code 工作流程的支援。

開發者詳細資訊

作者

AgentSecOps

授權

MIT

作者版本

v0.1.0

Skillstore 修訂

儲存庫

https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/analysis-tshark

引用

9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2

維護新鮮度

2026/7/25

使用量

8 次下載 · 331 次瀏覽

檔案結構

📁 assets/

📄 .gitkeep

📄 ci-config-template.yml

📄 rule-template.yaml

📁 references/

📄 EXAMPLE.md

📄 WORKFLOW_CHECKLIST.md

📄 SKILL.md