← All skills
malware-analysis
42 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a research skill usually looks things up on the internet.
By gl0bal01/malware-analysis-claude-skills (GitHub) · research · 54 stars · scanned at commit e1d9a1a
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 25 places.
Show 17 more
- README.md, line 315
pip install pefile yara-python sigma-cli pysigma-backend-splunk pysigma-pipeline-sysmon - detection-engineer/SKILL.md, line 93
pip install ioc-fanger - detection-engineer/SKILL.md, line 366
pip install sigma-cli - malware-dynamic-analysis/SKILL.md, line 139
| `.evtx` | Windows: `Get-WinEvent -Path sysmon.evtx \| Select Id,TimeCreated,Message \| ConvertTo-Json -Depth 3 \| Out-File -Encoding utf8 sysmon.json`. Host/R - malware-dynamic-analysis/references/tool_setup.md, line 283
sudo apt install inetsim - malware-dynamic-analysis/references/tool_setup.md, line 323
pip install flare-fakenet-ng - malware-report-writer/SKILL.md, line 126
command -v yara || echo "yara not installed: pip install yara-python / apt install yara — mark rule UNTESTED" - malware-triage/scripts/pe_info.py, line 14
Requires: pefile (pip install pefile) - malware-triage/scripts/pe_info.py, line 28
print("pefile is required: pip install pefile", file=sys.stderr) - references/mcp_integrations.md, line 13
"command": "npx", - references/mcp_integrations.md, line 51
"command": "npx", - references/mcp_integrations.md, line 92
pip install threatzonemcp - references/mcp_integrations.md, line 141
"command": "npx", - references/mcp_integrations.md, line 209
"command": "npx", - specialized-file-analyzer/SKILL.md, line 99
sys.exit("pip install pefile") - specialized-file-analyzer/SKILL.md, line 225
pip install oletools # olevba, oleid, rtfobj, mraptor - specialized-file-analyzer/SKILL.md, line 287
pip install oletools
and 5 more places
Runs commands on your computer
The author does not mention this.
Found in 77 places.
Show 17 more
- detection-engineer/SKILL.md, line 93
pip install ioc-fanger - detection-engineer/SKILL.md, line 107
echo "http://malicious.com/payload.exe" | sed 's/http:/hxxp:/g; s/\./[.]/g' - detection-engineer/SKILL.md, line 366
pip install sigma-cli - detection-engineer/SKILL.md, line 534
suricata -T -c /etc/suricata/suricata.yaml -S custom.rules - malware-dynamic-analysis/SKILL.md, line 105
P=capture.pcapng - malware-dynamic-analysis/SKILL.md, line 151
E=/path/to/evidence - malware-dynamic-analysis/SKILL.md, line 161
python3 malware-dynamic-analysis/scripts/procmon_summary.py "$E/procmon.csv" --process sample.exe > "$E/procmon_summary.txt" - malware-dynamic-analysis/SKILL.md, line 169
grep -F '"powershell.exe"' "$E/procmon.csv" | cut -d, -f2,4,5 | sort | uniq -c | sort -rn | head -40 - malware-dynamic-analysis/SKILL.md, line 181
python3 malware-dynamic-analysis/scripts/sysmon_summary.py "$E/sysmon.json" --process sample.exe > "$E/sysmon_summary.txt" - malware-dynamic-analysis/SKILL.md, line 206
cat "$E/dns.txt" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -30 - malware-dynamic-analysis/SKILL.md, line 217
python3 - "$E/syn.txt" <<'EOF' - malware-dynamic-analysis/SKILL.md, line 236
cat "$E/persistence.txt" - malware-dynamic-analysis/SKILL.md, line 253
cat "$E/dropped_hashes.csv" - malware-dynamic-analysis/SKILL.md, line 266
jq -r '.. | .processes? // empty' report.json | head; jq -r '.. | .network? // empty' report.json | head - malware-dynamic-analysis/SKILL.md, line 272
cat "$E/procmon_summary.txt" "$E/sysmon_summary.txt" "$E"/dns.txt "$E"/http.txt "$E"/tls.txt "$E"/persistence.txt 2>/dev/null | python3 scripts/ioc_extract.py > - malware-report-writer/SKILL.md, line 126
command -v yara || echo "yara not installed: pip install yara-python / apt install yara — mark rule UNTESTED" - malware-triage/SKILL.md, line 19
command -v file strings upx 7z yara; python3 -c "import pefile" 2>&1 | tail -1
and 57 more places
Sends data to these websites: remnux.org
This is disclosed by the author in the skill's SKILL.md or README. Expected for a research skill.
Found in 5 places.
Show 2 more
Changes files outside its own folder
The author does not mention this.
Found in 1 place.
Reads your browser cookies or saved passwords
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (research) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'malware-analysis' ] || [ -L ~/.agents/skills/'malware-analysis' ]; then echo 'A skill folder named malware-analysis already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/gl0bal01/malware-analysis-claude-skills' "$d" && git -C "$d" checkout --quiet 'e1d9a1a8e18e3db8f3534436cfc763c53b6b3350' -- '.' && mkdir -p ~/.agents/skills && cp -R "$d/." ~/.agents/skills/'malware-analysis' && rm -rf ~/.agents/skills/'malware-analysis'/.git && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'malware-analysis' ~/.claude/skills/'malware-analysis' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for gl0bal01/malware-analysis-claude-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/gl0bal01/malware-analysis-claude-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | e1d9a1a | 42 |