Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beaconing through connection interval/jitter stats, spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate issuers, using the bundled scripts/agent.py.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-traffic-analysis-with-arkimenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-traffic-analysis-with-arkime -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-traffic-analysis-with-arkime -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/implementing-network-traffic-analysis-with-arkimegh skill install mukul975/Anthropic-Cybersecurity-Skills implementing-network-traffic-analysis-with-arkimegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/implementing-network-traffic-analysis-with-arkime ~/.claude/skills/implementing-network-traffic-analysis-with-arkime # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/implementing-network-traffic-analysis-with-arkime ~/.agents/skills/implementing-network-traffic-analysis-with-arkime # Codex, Cursor, Gemini CLI, Copilot, OpenCode