Skip to content
Get packs

Guide · Agent skill

How to use the Automated Malware Submission Pipeline agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill: a folder of instructions and example code that a Claude agent loads when your request matches its description. The building-automated-malware-submission-pipeline skill guides the agent in designing and writing a pipeline that collects suspicious files from endpoint quarantine and email gateways, checks their hashes against VirusTotal and MalwareBazaar, and prepares the rest for sandbox analysis. After this guide you will know how to install it, how to phrase a request that triggers it, and what you must have in place before running any code it produces.

Automated Malware Submission Pipelinemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder.
  2. 2Or upload it in the Claude apps. Open Settings → Capabilities → Skills and upload the ZIP if that option is available to you.
  3. 3Install Python libraries. Install requests, vt-py and pefile on a Python 3.8+ system inside your isolated analysis environment.
  4. 4Gather API access and a sandbox. Obtain a VirusTotal API key, MalwareBazaar access and a sandbox such as Cuckoo Sandbox, Joe Sandbox, Any.Run or VMRay.
  5. 5Describe your triage problem. Ask the agent in plain terms to build a collector, pre-screen or sandbox step, naming your data sources.
  6. 6Review the generated code. Read each script, adapt the endpoints and field names to your systems, and check the verdict logic.
  7. 7Test in isolation. Run the pipeline only on the isolated analysis network and confirm verdicts against known samples before relying on them.

What the skill makes the agent do

The skill is aimed at security teams that have more suspicious-file alerts than they can send to a sandbox by hand. It covers three stages: collecting files, pre-screening them by hash, and submitting unknown files to a sandbox for dynamic analysis.

For each file, the pre-screen step looks up the SHA-256 hash in VirusTotal and MalwareBazaar. The source's example logic labels a file KNOWN_MALICIOUS when VirusTotal reports more than 10 malicious detections, LIKELY_CLEAN when it reports zero, and UNKNOWN otherwise, and marks UNKNOWN files as needing a sandbox. The output is a provisional verdict with hash and IOC summaries intended to feed SIEM tools.

  • Collect: pull quarantined files from an EDR quarantine API or extract attachments from email gateway exports.
  • Pre-screen: look up hashes in VirusTotal and MalwareBazaar before any upload.
  • Sandbox: submit unknown files to a sandbox such as Cuckoo Sandbox, Joe Sandbox, Any.Run or VMRay.
  • Summarise: produce verdicts and hash/IOC summaries for a SIEM.

Install the skill (ZIP or Claude apps upload)

Download the ZIP for this skill from this page and unzip it. The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md. For a personal setup, unzip it into ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills, if your plan and workspace offer that option.

  • Personal: ~/.claude/skills/building-automated-malware-submission-pipeline/
  • Project: .claude/skills/building-automated-malware-submission-pipeline/ inside your repository
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check the requirements before you start

The skill assumes a working security environment. Gather these before asking the agent to build anything that touches real files:

  • Python 3.8 or newer, with the requests, vt-py and pefile libraries
  • A VirusTotal API key. The source notes Enterprise tier is needed for submission; free access is enough for lookups.
  • MalwareBazaar API access
  • A sandbox service such as Cuckoo Sandbox, Joe Sandbox, Any.Run or VMRay
  • An EDR quarantine API and/or an email gateway export
  • An isolated analysis network with no production connectivity
pip install requests vt-py pefile

Trigger the skill with natural requests

You do not need to name the skill. Describe the problem in security terms and the agent should match it to the skill's description, which covers SOC teams scaling malware analysis beyond manual sandbox submissions for high-volume alert triage. Mention the concrete inputs and outputs you have, such as quarantine exports, hashes or a SIEM.

  • Help me write a Python pipeline that takes EDR quarantined files, checks their SHA-256 in VirusTotal and MalwareBazaar, and sends unknown ones to Cuckoo.
  • Our email gateway exports quarantined .eml files. Write a collector that extracts attachments, hashes them and records sender and subject.
  • Design an alert triage flow that outputs a verdict and IOC summary per file for our SIEM.

Examples of what you get back

The source includes three building blocks the agent can adapt: a collector class that saves samples named by SHA-256 and computes MD5, SHA1 and SHA-256; a pre-screener that calls the VirusTotal v3 file endpoint and the MalwareBazaar get_info query; and a sandbox submitter that posts files to Cuckoo's /tasks/create/file endpoint. Treat these as starting points to review, not finished production code.

POST https://mb-api.abuse.ch/api/v1/ (data: query=get_info, hash=<sha256>)

Safety notes: scripts and network access

This skill runs scripts and uses the network. The skill itself says not to analyse live malware on production or general-purpose machines. Run anything it generates only inside an isolated sandbox network, because a mistake can lead to infection or lateral spread.

Do not rely on verdicts alone. The example logic is simplistic, and a count above 10 is treated as known malicious, so files can be misclassified and real threats missed or wrongly labelled. Keep your API keys out of shared prompts and code.

  • Run only in an isolated analysis network.
  • Review every script before executing it.
  • Treat verdicts as provisional and confirm high-impact decisions with an analyst.
  • Protect VirusTotal and MalwareBazaar keys and the sandbox URL.

Tips for better results

Give the agent your real data shape: the EDR's field names, the gateway's export format and the sandbox you run. Ask it to note which parts of the code you must adapt. If you are a student, ask it to explain each stage so you learn how such pipelines are structured.

  • State your sandbox (Cuckoo, Joe Sandbox, Any.Run or VMRay) so the submission code matches it.
  • Ask for logging and error handling around API calls, since lookups can fail.
  • Ask the agent to point out where the logic could misclassify files and how you would test it.

What people use it for

  • Pulling quarantined files from an EDR, hashing them and skipping sandbox uploads for hashes already known as malicious.
  • Extracting attachments from quarantined .eml messages and recording sender and subject with each sample.
  • Sending unknown files to a Cuckoo Sandbox REST endpoint and collecting task IDs for later review.
  • Producing a per-file summary of hashes, detection counts and threat labels for SIEM ingestion.

Frequently asked questions

How do I install the building-automated-malware-submission-pipeline skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

Is this skill free to use?

The skill is licensed under Apache-2.0. The services it calls have their own access terms: the source says VirusTotal submission needs Enterprise tier, while lookups are free, and MalwareBazaar needs API access. Check each provider's current terms.

What do I need to run it?

You need Python 3.8+ with requests, vt-py and pefile, a VirusTotal API key, MalwareBazaar API access, a sandbox service, an EDR quarantine API and/or email gateway export, and an isolated analysis network.

Can I use it without a sandbox or paid API access?

The source lists sandbox access and VirusTotal submission as prerequisites, so the full pipeline is not meant to run without them. Hash lookups alone may work with a free VirusTotal key, but confirm the endpoints you need against your access level.

Why does the agent say a file is malicious when it is not?

The example logic labels a file known malicious when VirusTotal reports more than 10 malicious detections, which is simplistic and can misclassify files. Review the threshold and treat verdicts as provisional.

How does this compare with running a sandbox by hand?

The skill aims to scale triage beyond manual sandbox uploads by automating collection, hash pre-screening and submission. It is a guide plus example code, not a turnkey product, so it needs more engineering effort than a commercial tool.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Choose this skill if you are a SOC engineer, security developer or student who wants a structured, adaptable starting point for automated malware triage in an isolated lab. Pick something else if you need a turnkey tool, cannot run code in an isolated network, or cannot pay for the required API access.

Download the skill