How to use the Malpedia Malware Family Lookup agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and optional scripts that an AI agent can load when a task matches the skill's description. This one is built for malware family research. Once installed, the agent can query Malpedia to find what other names a piece of malware goes by, which threat groups are linked to it, and which community or vendor YARA rules exist for it.

The skill can also sketch how families relate to each other, such as loaders that deliver other malware, or tools written by the same actor. It includes a Python script, scripts/agent.py, that calls the Malpedia API to automate these lookups.

• Look up a family's aliases and naming, for example win.emotet
• Pull YARA rules recorded for a family
• List malware families associated with a threat actor
• Map relationships such as loader-payload chains and shared authorship

Who should use it, and who should not

The skill suits threat intelligence analysts researching a family's aliases or lineage, detection engineers who need existing YARA rules for a known family, and security teams mapping which threat actors use a given malware.

It is not for analysing a live infection or raw samples. It only queries public catalogue data, not files on your machine, and it does not replace sandboxing or reverse engineering. It also needs a Malpedia account, because the API requires a personal API key.

Install the skill (ZIP download or Claude apps upload)

Download the skill ZIP from this page and unzip it. For Claude Code, place the unzipped skill folder in ~/.claude/skills/ to make it available for you personally, or in a project's .claude/skills/ folder to share it with that project.

If you use the Claude apps, you can upload the skill instead under Settings → Capabilities → Skills.

The folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. Keep this structure intact so the agent can find the instructions and the API notes.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Install the required Python libraries and get an API key

The skill needs Python 3.9 or newer, plus the requests, yara-python and stix2 libraries. Install these in the Python environment the agent will use.

You also need a Malpedia API key. Registration is free and happens at malpedia.caad.fkie.fraunhofer.de. The API authenticates with an apitoken header, so lookups fail without a key. Store the key where the agent can read it and do not paste it into public files.

• Python 3.9+
• requests
• yara-python
• stix2
• Malpedia API key (free registration)

How to trigger the skill with natural requests

You do not need to name the skill. The agent loads it when your request matches its description, which covers researching a family's aliases, lineage or actor attribution, and sourcing YARA rules for detection. Name the malware family or threat actor clearly, and say what you want back.

Malpedia names families in the form platform.family_name, such as win.emotet, elf.mirai or apk.flubot. Using this format, or a well-known family name, makes lookups more precise.

• What other names is win.emotet known by in Malpedia?
• List the YARA rules Malpedia holds for win.cobalt_strike.
• Which malware families is this threat actor linked to in Malpedia?
• Map the loader-payload chain around a given family and its shared authorship.

Safety notes: scripts and network access

This skill runs scripts and uses the network. Its script calls the Malpedia API over HTTPS at malpedia.caad.fkie.fraunhofer.de, so your API key and queries leave your machine. Read scripts/agent.py before running it, and use a key you can revoke.

The skill is for public catalogue data. Do not feed it live malware or sensitive case material expecting analysis of files. Keep sandboxed analysis and reverse engineering as separate steps.

• Review scripts/agent.py before first use
• Treat your API key as a credential
• Use it for catalogue lookups, not sample analysis

Tips for better results

Start with a specific family name in platform.family_name form. Broad keywords return many matches, so narrow the question if the result list is long.

Ask for the output you need, such as aliases, YARA rules or linked actors, rather than a general summary. Check any attribution against the reference URLs Malpedia provides for the family.

• Use the platform prefix when you know it
• Ask for one output type at a time
• Verify attributions against the family's reference URLs