Guide · Agent skill
How to use the Analyzing Indicators of Compromise agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This skill gives an AI agent a structured way to triage indicators of compromise (IOCs) such as IP addresses, domains, file hashes, URLs and email addresses. It checks them against threat intelligence services, applies a scoring framework and suggests a disposition: block, monitor, whitelist or false positive. It is aimed at SOC analysts, security engineers and threat intelligence teams. After this guide you will know how to install the skill, trigger it with plain requests, and what accounts and keys you need before it works.
Analyzing Indicators of Compromisemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ or in your project's .claude/skills/ folder.
- 2Get your API keys. Obtain a VirusTotal API key and an AbuseIPDB API key, and confirm access to MalwareBazaar through abuse.ch.
- 3Install Python dependencies. Make sure Python 3 with the requests library is available. Add vt-py, pymisp and tldextract if you plan to use those features.
- 4Start a request with indicators. Ask the agent in plain language to triage or enrich specific IOCs, and name the sources you want checked.
- 5Review the enrichment results. Check the scores, detection counts and campaign matches the agent reports against your own knowledge of the environment.
- 6Apply the disposition and document it. Use the suggested block, monitor, whitelist or false positive decision, then record the rationale, sources and ticket number in your TIP or MISP.
What does the skill make the agent do?
The skill is a set of instructions (SKILL.md) plus reference notes and a Python helper. When you give the agent indicators from a phishing email, an alert or a threat feed, it follows a workflow: classify each indicator, enrich it with multiple sources, add campaign context, assign a confidence score and disposition, then document the decision.
It only works on indicators you supply. It enriches and scores them; it does not detect threats on its own.
- Classifies IPs, domains, URLs, file hashes and email addresses
- Looks up reputation in VirusTotal, AbuseIPDB and MalwareBazaar
- Checks MISP for related events and Shodan for hosting context
- Suggests Block (high confidence), Monitor (medium), Whitelist/Investigate (low) or False Positive
- Reminds you to record the findings and rationale in your TIP or MISP
Install the skill (ZIP download or upload)
Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/analyzing-indicators-of-compromise/
- Project: .claude/skills/analyzing-indicators-of-compromise/ inside your project
- The package contains SKILL.md, scripts/agent.py and references/api-reference.md
Get the accounts and keys you need
Most lookups need API keys. The skill's prerequisites list a VirusTotal API key (free or Enterprise), an AbuseIPDB API key, and access to MalwareBazaar through the abuse.ch API. Python 3 with the requests library is needed for the bundled script and API calls.
Optional extras are a MISP instance or other threat intelligence platform, the Python libraries pymisp, vt-py and tldextract, and a Shodan account. The skill notes that without MISP or a TIP you can still run enrichment, but campaign cross-referencing will not happen.
- VirusTotal API key (free or Enterprise)
- AbuseIPDB API key
- MalwareBazaar access (abuse.ch API)
- Python 3 with requests
- Optional: pymisp, vt-py, tldextract, a MISP instance and a Shodan account
Trigger the skill with natural requests
You do not need a special command. Describe the job in plain language and mention the indicators. The skill's description lists triggers such as triaging IOCs from phishing emails, security alerts or external threat feeds, enriching raw IOCs, making block/monitor/whitelist decisions, and requests that mention VirusTotal, AbuseIPDB, MalwareBazaar, MISP or IOC enrichment pipelines.
Include the indicators themselves and say what you want back. Defanged values (for example evil[.]com) are fine to paste.
- "Triage these IOCs from a phishing email: hxxp://evil[.]com/login, 203.0.113.45, and the SHA-256 below. Recommend block, monitor or whitelist for each."
- "Enrich this IP with AbuseIPDB and tell me whether it is a CDN or a legitimate cloud provider."
- "Check this file hash on VirusTotal and MalwareBazaar and summarise the detection count and malware family."
- "Classify these indicators and defang them so I can paste them into our Confluence ticket."
Use the bundled helper for defanging and refanging
The skill includes scripts/agent.py, a Python helper that classifies indicators, defangs them for safe documentation and refangs them for querying. Defanging replaces dots with [.] and :// with [://], which stops accidental clicks and automated scanning of pasted indicators.
Run the helper only after reading it. The skill's scripts make network calls, so review the code and make sure your API keys are supplied in a way that fits your security policy.
- Defang before pasting IOCs into emails, tickets or wikis
- Refang only in a controlled environment before querying
- Confirm the helper's usage in scripts/agent.py before running it
hxxp://evil[.]com/login -> defang form of http://evil.com/loginRead the scoring framework before acting
The skill applies tiered thresholds. Block (high confidence, 70% or above) is used for 15 or more VirusTotal AV detections, an AbuseIPDB score of 70 or higher, or a match to a known malware family or campaign. Monitor/Alert (40 to 69%) covers 5 to 14 detections with a moderate AbuseIPDB score and no campaign link. Whitelist/Investigate (below 40%) covers 4 or fewer detections, no abuse reports, and legitimate services such as Google or Cloudflare CDN addresses.
A False Positive is a legitimate business service that was wrongly flagged; document it and exclude it from future alerts.
- Block: high confidence, 70% or above
- Monitor/Alert: medium, 40 to 69%
- Whitelist/Investigate: low, below 40%
- False Positive: document and exclude from future alerts
Avoid common mistakes
The skill's pitfalls section names several errors. Blocking shared CDN or cloud IPs can disrupt many legitimate sites. A low VirusTotal count does not prove an indicator is safe, because new malware often scores zero at first. Use three or more independent sources for high-stakes decisions.
Set expiration (TTL) policies. The skill suggests IP indicators expire after 30 days and domains after 90 days, so old entries do not block legitimate users indefinitely.
- Do not block shared CDN or cloud IPs on enrichment alone
- Check sandbox behaviour, MISP and passive DNS when VirusTotal is quiet
- Use 3+ sources for high-stakes decisions
- Set TTLs: 30 days for IPs, 90 days for domains
What people use it for
- Triaging IOCs extracted from a phishing email before deciding what to block at the proxy or DNS layer
- Enriching a batch of IPs from a threat feed to separate likely malicious addresses from shared cloud infrastructure
- Checking a suspicious file hash against VirusTotal and MalwareBazaar to get detection counts and malware tags
- Preparing defanged indicators for an incident ticket or internal wiki without risking accidental clicks
Frequently asked questions
Is the Analyzing Indicators of Compromise skill free?
The skill is released under the Apache-2.0 licence. Several services it uses have free tiers, such as VirusTotal's free API key and MalwareBazaar, but the skill's source does not state prices, so check each provider's terms.
What do I need to install this agent skill?
You need Python 3 with the requests library, a VirusTotal API key, an AbuseIPDB API key and access to MalwareBazaar through abuse.ch. MISP, pymisp, vt-py, tldextract and a Shodan account are optional extras.
Where do I put the skill folder?
Place it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill run code and make network requests?
Yes. The skill runs scripts (scripts/agent.py) and uses the network to call VirusTotal, AbuseIPDB, MalwareBazaar and optionally MISP and Shodan. Review the scripts and handle your API keys according to your security policy.
Can this skill replace an analyst's decision on blocking?
No. The skill itself warns against using it alone for high-stakes blocking decisions, especially for shared CDN or cloud infrastructure. It is meant to support analyst judgement, not replace it.
What are alternatives to this skill for IOC enrichment?
The source mentions a SOAR platform with pre-built connectors as an alternative to the Python approach, and lists URLScan.io as a free URL analysis service. This page does not compare the skill against specific commercial products.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts, security engineers and threat intelligence teams who already hold the relevant API keys and want a consistent, documented way to triage and score indicators. It is a poor fit for anyone without those accounts, or anyone expecting automatic threat detection, since it only enriches and scores indicators you provide and should be checked by a human before blocking.
Download the skill