malware-dynamic-analysis

67 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a research skill usually looks things up on the internet.

By gl0bal01/malware-analysis-claude-skills (GitHub) · research · 54 stars · scanned at commit e1d9a1a

Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped files, persistence, or injection must be observed. Claude produces a tailored VM runbook from triage predictions, then parses the exported text evidence (Procmon CSV, Sysmon JSON/CSV, tshark output, autoruns, strings) on the host to reconstruct behavior and extract IOCs. The analyst runs the VM; Claude never executes the sample.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this.

Found in 11 places.

malware-dynamic-analysis/SKILL.md, line 105P=capture.pcapng
malware-dynamic-analysis/SKILL.md, line 151E=/path/to/evidence
malware-dynamic-analysis/SKILL.md, line 161python3 malware-dynamic-analysis/scripts/procmon_summary.py "$E/procmon.csv" --process sample.exe > "$E/procmon_summary.txt"

Show 8 more

malware-dynamic-analysis/SKILL.md, line 169grep -F '"powershell.exe"' "$E/procmon.csv" | cut -d, -f2,4,5 | sort | uniq -c | sort -rn | head -40
malware-dynamic-analysis/SKILL.md, line 181python3 malware-dynamic-analysis/scripts/sysmon_summary.py "$E/sysmon.json" --process sample.exe > "$E/sysmon_summary.txt"
malware-dynamic-analysis/SKILL.md, line 206cat "$E/dns.txt" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -30
malware-dynamic-analysis/SKILL.md, line 217python3 - "$E/syn.txt" <<'EOF'
malware-dynamic-analysis/SKILL.md, line 236cat "$E/persistence.txt"
malware-dynamic-analysis/SKILL.md, line 253cat "$E/dropped_hashes.csv"
malware-dynamic-analysis/SKILL.md, line 266jq -r '.. | .processes? // empty' report.json | head; jq -r '.. | .network? // empty' report.json | head
malware-dynamic-analysis/SKILL.md, line 272cat "$E/procmon_summary.txt" "$E/sysmon_summary.txt" "$E"/dns.txt "$E"/http.txt "$E"/tls.txt "$E"/persistence.txt 2>/dev/null | python3 scripts/ioc_extract.py >

Downloads and installs other software

The author does not mention this.

Found in 3 places.

malware-dynamic-analysis/SKILL.md, line 139| `.evtx` | Windows: `Get-WinEvent -Path sysmon.evtx \| Select Id,TimeCreated,Message \| ConvertTo-Json -Depth 3 \| Out-File -Encoding utf8 sysmon.json`. Host/R
malware-dynamic-analysis/references/tool_setup.md, line 283sudo apt install inetsim
malware-dynamic-analysis/references/tool_setup.md, line 323pip install flare-fakenet-ng

Sends data to these websites: remnux.org

This is disclosed by the author in the skill's SKILL.md or README. Expected for a research skill.

Found in 1 place.

malware-dynamic-analysis/references/sandbox_setup.md, line 19wget https://REMnux.org/remnux-cli

Changes files outside its own folder

The author does not mention this.

Found in 1 place.

malware-dynamic-analysis/references/sandbox_setup.md, line 20mv remnux-cli /usr/local/bin/remnux

Safer alternatives

Low-risk skills in the same category (research) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'malware-dynamic-analysis' ] || [ -L ~/.agents/skills/'malware-dynamic-analysis' ]; then echo 'A skill folder named malware-dynamic-analysis already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/gl0bal01/malware-analysis-claude-skills' "$d" && git -C "$d" checkout --quiet 'e1d9a1a8e18e3db8f3534436cfc763c53b6b3350' -- 'malware-dynamic-analysis' && mkdir -p ~/.agents/skills && cp -R "$d"/'malware-dynamic-analysis' ~/.agents/skills/'malware-dynamic-analysis' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'malware-dynamic-analysis' ~/.claude/skills/'malware-dynamic-analysis' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for gl0bal01/malware-analysis-claude-skills shows the score of its lowest-scoring skill.

SkillTrust badge for gl0bal01/malware-analysis-claude-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/gl0bal01/malware-analysis-claude-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/gl0bal01/malware-analysis-claude-skills/)

Score history

Date	Version	Score
2026-11-07	`e1d9a1a`	67