Guide · Agent skill
How to use the offensive-keylogger-arch agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
offensive-keylogger-arch is an agent skill: a folder containing one written methodology file, SKILL.md, that tells an AI agent how to reason about Windows keyboard-capture software. It is aimed at security researchers, malware analysts and students who want a structured checklist of hook types, capture methods and the detectable indicators each one leaves behind. This guide explains what the skill does, how to install it, how to phrase requests so it activates, and where its limits are.
Keylogger Architecture Research NotesSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the ZIP from this skill's page in the directory. It contains SKILL.md.
- 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. The result should be a folder containing SKILL.md.
- 3Or upload in the Claude apps. In the Claude apps, open Settings → Capabilities → Skills and upload the skill.
- 4Ask a defensive question. Write a normal request that includes a trigger term such as WH_KEYBOARD_LL or keyboard hook, and state your research purpose.
- 5Work through the checklist. Ask the agent to track which techniques it has covered and to list indicators for each one.
- 6Verify before relying on it. Check specific Windows internals claims against official Microsoft documentation.
What the skill makes the agent do
Once the skill is loaded, the agent applies the methodology in SKILL.md as a checklist. The file covers SetWindowsHookEx and the WH_KEYBOARD_LL low-level hook, raw-input registration, ETW-based capture, user-mode versus kernel-mode designs, stealth and data exfiltration. For each technique the agent considers how it applies to the context you describe, tracks which items have been covered, and suggests next steps.
The main value is the indicator angle. The listing describes the agent noting what each technique would leave behind as detectable indicators, such as a hook visible from user32, a mapped DLL, or a change in input responsiveness. The skill itself contains no executable code. It is a reference and analysis aid, and its answers depend largely on the agent's own knowledge.
Install the skill from the download ZIP
Download the ZIP from the skill's page in this directory. The listing's only file is SKILL.md, so the unzipped result should be a folder named offensive-keylogger-arch that contains SKILL.md.
For a personal install, place that folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder instead. Claude Code will then find the skill when you work in that location.
If you use the Claude apps rather than a folder on disk, upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/offensive-keylogger-arch/
- Project: .claude/skills/offensive-keylogger-arch/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with natural requests
The skill activates when your conversation involves terms from its trigger list. These include keylogger, keyboard hook, WH_KEYBOARD_LL, SetWindowsHookEx, ETW, kernel driver, input capture, low-level keylogger, malware architecture, stealth and exfiltration. You do not need to type a command. Write a normal question that includes one of these terms and state your defensive purpose.
Keep requests framed around analysis and detection. Good requests ask what a technique leaves behind, how an analyst would spot it, or how the architectures differ. The listing's own guidance is that this is a research and analysis aid, not a deployment guide.
- Walk me through the indicators a WH_KEYBOARD_LL hook would leave on an endpoint, for a detection rule review.
- Compare user-mode and kernel-mode keyboard capture designs from a malware analyst's point of view.
- Make a checklist of what an EDR should look for around SetWindowsHookEx, and tell me what to verify next.
- Explain why low-level hooks can affect system responsiveness and how that could be noticed.
Examples of useful sessions
A detection engineer can use the skill to build a review list. Ask for the techniques in the methodology, the indicator for each, and which logs or telemetry would show it. Then ask the agent to suggest next steps and verify each claim against Microsoft's documentation before you rely on it.
A student can use it to learn Windows input architecture. Ask the agent to explain the difference between a global hook and a low-level hook, then ask what each design means for visibility and detection. Treat the answers as a starting point for reading primary sources.
What it needs, and safety notes
The listing lists no requirements. The skill runs no scripts and makes no network calls. Installing it means copying one Markdown file into a skills folder.
The methodology describes attack techniques and evasion. The listing states the skill is not for building working keylogger code or step-by-step deployment, and it is not for monitoring another person's keyboard without consent, which is illegal in most places. Use it only for research, analysis and defence, and follow your organisation's rules and the law where you are.
- No scripts run and no network access is used, according to the listing.
- SKILL.md contains no executable code.
- Do not use the output to monitor anyone without their consent.
Tips for better results
The source file is terse notes with some unfinished questions, so ask narrow questions rather than broad ones. Check any specific claim about Windows internals against official documentation, because the agent may fill gaps from its own knowledge.
If the skill does not seem to activate, confirm that the folder is named offensive-keylogger-arch, that SKILL.md sits directly inside it, and that the folder is in the path you chose. Then include one of the trigger terms in your request.
- Name the specific hook type or technique you care about.
- State your defensive goal, such as detection rule design or malware triage.
- Ask for indicators and next steps, not implementation details.
What people use it for
- Building a detection review list for keyboard hook techniques on Windows endpoints.
- Learning how user-mode and kernel-mode input capture designs differ at a conceptual level.
- Triaging a suspicious sample by comparing its behaviour against the hook and indicator categories in the methodology.
- Preparing questions for a malware analysis report or a student write-up on endpoint detection.
Frequently asked questions
Is the offensive-keylogger-arch skill free?
The listing gives the licence as MIT. It does not state a price, so check the directory page for any terms before you use it.
What does the offensive-keylogger-arch skill require?
The listing lists no requirements. It runs no scripts and uses no network, and the only file is SKILL.md.
Does this skill include working keylogger code?
No. The listing says SKILL.md contains no executable code. It is a written methodology that the agent applies as a checklist, and the listing says it is not for working code or step-by-step deployment.
How do I install an agent skill like this one?
Download the ZIP, unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.
Why isn't my skill triggering?
Check that the folder is named offensive-keylogger-arch and that SKILL.md sits directly inside it. Then include a trigger term such as keyboard hook, SetWindowsHookEx or ETW in your request.
Can I use this skill to monitor someone else's keyboard?
No. The listing says it is not for monitoring another person's keyboard without consent, which is illegal in most places. Use it for research, analysis and defence only.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers, malware analysts and students who want a structured checklist of Windows keyboard-capture techniques and their detection indicators. It is a reference aid with terse source notes, so people who want a beginner tutorial, working code or deployment steps should pick a different resource.
Download the skill