ctf-malware

84 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By ljagiello/ctf-skills (GitHub) · coding · 3,679 stars · scanned at commit e79be29

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indi…

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

This is disclosed by the author in the skill's SKILL.md or README.

Found in 3 places.

ctf-malware/SKILL.md, line 20pip install yara-python pefile capstone oletools unicorn pycryptodome \
ctf-malware/SKILL.md, line 26apt install strace ltrace tshark binwalk binutils
ctf-malware/SKILL.md, line 31brew install wireshark binwalk binutils ghidra

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 12 places.

ctf-malware/SKILL.md, line 20pip install yara-python pefile capstone oletools unicorn pycryptodome \
ctf-malware/SKILL.md, line 26apt install strace ltrace tshark binwalk binutils
ctf-malware/SKILL.md, line 31brew install wireshark binwalk binutils ghidra

Show 9 more

ctf-malware/SKILL.md, line 58file suspicious_file
ctf-malware/SKILL.md, line 94tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
ctf-malware/SKILL.md, line 123peframe malware.exe # Quick triage
ctf-malware/SKILL.md, line 161ar -x package.deb && tar -xf control.tar.xz # Check postinst scripts
ctf-malware/SKILL.md, line 181strings malware | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
ctf-malware/scripts-and-obfuscation.md, line 128tcpdump = subprocess.Popen(
ctf-malware/scripts-and-obfuscation.md, line 130stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
ctf-malware/scripts-and-obfuscation.md, line 134result = subprocess.run(
ctf-malware/scripts-and-obfuscation.md, line 139except subprocess.TimeoutExpired:

Sends data to these websites: api.telegram.org, {domain}

This is disclosed by the author in the skill's SKILL.md or README.

Found in 4 places.

ctf-malware/c2-and-protocols.md, line 135r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates")
ctf-malware/c2-and-protocols.md, line 138r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")
ctf-malware/c2-and-protocols.md, line 140requests.get(f"https://api.telegram.org/file/bot{TOKEN}/{file_path}")

Show 1 more

ctf-malware/scripts-and-obfuscation.md, line 446flag = requests.get(f"http://{domain}/{path}", cookies={"uuid": uuid}).text

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ctf-malware' ] || [ -L ~/.agents/skills/'ctf-malware' ]; then echo 'A skill folder named ctf-malware already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ljagiello/ctf-skills' "$d" && git -C "$d" checkout --quiet 'e79be2925d1612e8a97070d6201e300286672370' -- 'ctf-malware' && mkdir -p ~/.agents/skills && cp -R "$d"/'ctf-malware' ~/.agents/skills/'ctf-malware' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf-malware' ~/.claude/skills/'ctf-malware' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ljagiello/ctf-skills shows the score of its lowest-scoring skill.

SkillTrust badge for ljagiello/ctf-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ljagiello/ctf-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ljagiello/ctf-skills/)

Score history

Date	Version	Score
2026-11-11	`e79be29`	84
2026-11-08	`2ad85d3`	84
2026-11-07	`2ad85d3`	54