Is the NetFlows skill free?

Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.

What is the NetFlows SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.

How do I install NetFlows?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use NetFlows with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

NetFlows

Extracts pcap network flows and resolves them to hostnames via in-capture DNS

by BrownFineSecurity · BrownFineSecurity/iothackbot

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 14, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · e0bea4e

Built a synthetic pcap with scapy (a DNS-resolved 'C2 beacon' flow plus an unresolved IP) and ran the real netflows CLI end to end — it correctly resolved the beacon's hostname from the in-capture DNS response while correctly leaving the non-DNS'd IP as unresolved, matching the documented JSON schema exactly.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 4/5

What NetFlows does

Parses pcap/pcapng captures with scapy to list every TCP/UDP flow, builds a DNS resolution table from DNS responses found in the same capture, and maps destination IPs to hostnames wherever possible. Triggers when a user has a packet capture and wants to know what hosts a device (often an IoT device) talked to, with text, JSON, or quiet output and optional source-IP filtering.

How to install NetFlows

git clone https://github.com/BrownFineSecurity/iothackbot
cd iothackbot
mkdir -p ~/.claude/skills
cp -r skills/netflows ~/.claude/skills/netflows

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger NetFlows

/netflows Extracts pcap network flows and resolves them to hostnames via in-capture DNS

It also activates on plain-language prompts like these:

Parse this pcap and tell me what hosts my IoT device talked to
Extract every TCP and UDP flow from this capture with hostnames
Figure out what domains this device resolved during the capture

Frequently asked questions

Is the NetFlows skill free?: Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.
Does NetFlows work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Tested · Works. Built a synthetic pcap with scapy (a DNS-resolved 'C2 beacon' flow plus an unresolved IP) and ran the real netflows CLI end to end — it correctly resolved the beacon's hostname from the in-capture DNS response while correctly leaving the non-DNS'd IP as unresolved, matching the documented JSON schema exactly.
What is the NetFlows SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.
How do I install NetFlows?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use NetFlows with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.