Streaming PCAP/network capture analysis for IOC extraction. Parses DNS queries (UDP/53) and TLS SNI (TCP/443) from .pcap/.pcapng files using scapy's PcapReader generator (never loads full capture into RAM — OOM-hardened with 50MB file gate). Extracts unique domains, IPs, and server names, deduplicated via set(). Output can chain directly to intel-skill for OSINT enrichment. Trigger when user asks to analyze a pcap, network capture, traffic dump, extract IOCs from a capture file, or asks what domains/IPs a PCAP contacted.
EnglishWindows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.
English
AGENT SKILLS ATLASIncludes Pcap Analyst, Persistence Hunter, and other workflows.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLISupported by the Atlas install prompt. Skill-specific requirements vary.
Pack stats
What’s included
Pcap Analyst
Streaming PCAP/network capture analysis for IOC extraction. Parses DNS queries (UDP/53) and TLS SNI (TCP/443) from .pcap/.pcapng files using scapy's PcapReader generator (never loads full capture into RAM — OOM-hardened with 50MB file gate). Extracts unique domains, IPs, and server names, deduplicated via set(). Output can chain directly to intel-skill for OSINT enrichment. Trigger when user asks to analyze a pcap, network capture, traffic dump, extract IOCs from a capture file, or asks what domains/IPs a PCAP contacted.
Persistence Hunter
Windows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.
Currency Skill
Frankfurter API를 사용한 환율 정보 조회 스킬. 무료 오픈소스 환율 API로 유럽중앙은행(ECB) 데이터 기반. 사용 시점: (1) 환율 정보 조회, (2) 통화 변환 기능 구현, (3) 환율 시계열 데이터 필요, (4) 지원 통화 목록 확인
Quick start
- Choose your skills. Select individual skills above, or choose the entire pack.
- Copy the install prompt. Use Copy install prompt above the list.
- Send it to your agent. Paste into your coding agent’s chat. Your agent reviews the source and guides the setup.
Try it with your agent
After installation, start with a request like:
Use the Pcap Analyst skill to help with my task.
Ask me for the context you need before getting started.Requirements & license
- A coding agent that can access your project files and install skills.
- Your agent checks each skill’s instructions, dependencies, and permissions during setup.
- Reported license for the skills shown: AGPL-3.0. The author’s terms apply.