jmagly Analyze Network Capture
Analyze authorized saved capture bytes through the addon contracts. Preserve the source locally and return metadata-first evidence with reproducible citations.
Use this skill for packet-capture work; do not use for citation-network or bibliometric analysis.
Workflow
- Establish the capture path, collection authority, purpose, timezone/clock context, environment, expected traffic, retention, and output directory.
- Probe explicit
tsharkandcapinfospaths or configured trusted search roots. Report missing/incompatible tools and official install guidance; do not install software, edit profiles, or change capture privileges. - Reject live interfaces, URLs, compressed archives, non-regular/symlinked input, unsupported formats, missing bounds, and destinations outside the authorized root.
- Hash the source before analysis. Select a version-compatible recipe and keep capture filters separate from Wireshark display filters.
- Execute TShark with an absolute path, argument array, isolated configuration, shell disabled, cancellation, and input/time/packet/output bounds.
- Normalize volatile values, redact secrets and payloads, hash derived files, validate the evidence schema, and cite the exact capture digest plus frame or context-bound stream locator.
- Record errors and partial results without treating incomplete analysis as a successful finding. Re-verify the source hash before handoff.
Decisions
- Default to offline-only and metadata-only.
- Require an explicit payload opt-in before local payload output.
- Require a separate provider-disclosure decision for any model/provider transfer, including metadata or headers.
- Treat packet fields as observations. Label beaconing, exfiltration, root cause, attribution, and intent as inferences with inputs and false-positive notes.
- Offer a Termshark command preview only when the optional tool is compatible. Launch requires a separate explicit operator action and remains local.
References
- For core analysis and output behavior, read
@$AIWG_ROOT/agentic/code/addons/network-analysis/docs/offline-analysis.md. - For a named recipe, read only its entry under
@$AIWG_ROOT/agentic/code/addons/network-analysis/recipes/. - For research or framework handoff, read the relevant file under
@$AIWG_ROOT/agentic/code/addons/network-analysis/docs/integrations/. - Always follow
@$AIWG_ROOT/agentic/code/addons/network-analysis/rules/network-analysis-safety.md. - Canonical contracts are indexed at
@$AIWG_ROOT/agentic/code/addons/network-analysis/schemas/network-analysis-contracts.md.