Guide · Agent skill
How to use the Malware Analysis agent skill (malware-analysis)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The malware-analysis skill is a set of instructions that tells an AI agent how to work through a suspected malware sample in a structured way: quick triage, PE and import review, sandbox-based dynamic analysis, writing YARA and Sigma detection rules, and extracting indicators of compromise. It is aimed at security analysts, reverse engineers, students and threat intel teams working in an isolated lab. After this guide you will know how to install the skill, how to ask for it in plain language, what it needs on your machine, and where the safety limits are.
Malware Analysis Workflowzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip the malware-analysis folder. Confirm SKILL.md and the references folder are present.
- 2Place the skill. Copy the folder to ~/.claude/skills/ for personal use or to .claude/skills/ in a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare an isolated lab. Set up a dedicated VM or sandbox that you can reset, and keep it off your production network before you open any sample.
- 4Install the tools. Install the static tools the skill names, such as file, strings, rabin2, floss, pecheck, pescan and diec, plus a debugger or sandbox if you plan to use them.
- 5Ask in plain language. Describe the sample and the output you want, such as a triage summary, IOC list, YARA rule or Sigma rule.
- 6Review the evidence. Check which tool produced each finding and whether the agent marked anything as unverified before you rely on it.
What the skill makes the agent do
The skill is a written process, not a scanner. Once it is loaded, the agent follows a six-phase workflow when you give it a suspected sample: Phase 1 is triage with file type, string and hash tools; Phase 1b covers unpacking and rebuilding the import table when a sample is packed; Phase 2 is static analysis of imports, exports, resources and strings; Phase 3 is sandbox and debugger-based dynamic analysis; Phase 4 is writing YARA rules; Phase 5 is writing Sigma behaviour rules; Phase 6 is extracting and classifying IOCs.
The skill also covers common anti-analysis techniques such as debugger checks, VM and sandbox detection, timing delays and API hashing, and asks the agent to record evidence for each finding. The instructions are written mostly in Chinese and assume you already have a reverse engineer's toolkit.
- Triage: file type, strings, PE structure, packer identification, hashing
- PE header and import review, with a required import summary
- Sandbox and debugger workflow, including a fallback when the sample does nothing
- YARA and Sigma rule templates
- IOC types: network, host, behavioural and static
Install the skill (ZIP download or Claude apps upload)
Download the ZIP for this skill from this page and unzip it. For a personal install, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. The skill folder should contain SKILL.md and the references/ folder with anti-analysis-techniques.md, sandbox-orchestration.md, yara-sigma-rules.md.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/malware-analysis/
- Project: .claude/skills/malware-analysis/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
~/.claude/skills/malware-analysis/SKILL.mdInstall the analysis tools the skill expects
The skill does not bundle analysis tools. It tells the agent which ones to use and expects you to install them. Check which are available before you start, because the skill's first steps check tool availability and real paths.
Static tools named in the skill are file, strings, rabin2, floss, pecheck, pescan and diec (Detect It Easy). Disassemblers and debuggers named include IDA Pro, Ghidra, radare2 and x64dbg. Sandboxes named include CAPE, Cuckoo, Joe Sandbox and ANY.RUN, of which at least one is optional. Hash lookups refer to VirusTotal, MalwareBazaar and Triage.
- Required to follow the static steps: file, strings, rabin2, floss, pecheck, pescan, diec
- Disassembly and debugging: IDA Pro, Ghidra, radare2 or x64dbg
- Sandbox (optional but used in Phase 3): CAPE, Cuckoo, Joe Sandbox or ANY.RUN
Set up an isolated lab before you open a sample
The skill's workflow includes unpacking and debugger work, which runs code from the sample. The skill is written to be used in an authorised, isolated environment, and it does not provide that environment itself. Do not run unknown samples on a personal or production machine.
The skill's sandbox reference gives CAPE Sandbox as an open-source option with YARA integration, and describes running it on Ubuntu 22.04 or later with its own installer script. Check the project's own documentation before you install it. Once a CAPE instance is running, the reference shows submitting a file to its API on port 8000.
- Use a dedicated VM or sandbox that you can reset
- Keep it off your production network
- Do not store real credentials in the analysis VM
curl -F "file=@sample.exe" http://localhost:8000/apiv2/tasks/create/file/Trigger the skill with natural requests
You do not need a special command. Describe the task in plain language and say what you need back. The skill's description tells the agent to use it for suspected malware analysis, IOC extraction, YARA or Sigma rules, sandboxing and anti-analysis behaviour, so requests that mention those topics are the ones that will match.
Give the agent the sample's location and what you already know, such as whether it is packed or where it came from. Ask for the output you want: a triage summary, a YARA rule, an IOC list or a Sigma rule.
- "Analyse sample.exe in my lab VM and give me a triage summary."
- "Extract IOCs from this sample: domains, file paths, mutexes and registry keys."
- "Write a YARA rule for this family based on its strings and imports."
- "Draft a Sigma rule for the process injection behaviour you see in the sandbox."
- "The sample exits right away in the sandbox. What anti-analysis checks could explain that?"
Example workflow: triaging a suspicious executable
A typical first pass runs the static checks from Phase 1 on a file called sample.exe, then records the import summary as the skill requires. The agent should report each result, not just a final verdict.
The skill's quick-triage commands include the file type check, a string search for network and command-line terms, rabin2 string extraction, floss for obfuscated strings, pecheck, pescan, diec for packer or compiler identification, and a SHA-256 hash for lookups.
- Ask the agent to run file, strings and floss on the sample
- Ask for the PE structure check and the packer check
- Ask for the SHA-256 so you can look up the hash yourself
file sample.exe
strings sample.exe | grep -i "http\|cmd\|powershell\|base64"
rabin2 -zz sample.exe
floss sample.exe
pecheck sample.exe
pescan sample.exe
diec sample.exe
sha256sum sample.exeTips for getting useful results
The skill asks for a few evidence records and time limits. For example, if the sandbox shows no behaviour, the skill says to record that as a conditional result and not as proof the sample is harmless. Expect the agent to say what it could not verify.
The instructions are mostly in Chinese. If you work in English, say so in your request and ask for English output. Some referenced files are not part of this skill folder, so the agent may be unable to read them.
- Ask for evidence and state which tool produced each finding
- Accept "unknown" or "needs dynamic analysis" as a valid answer
- Ask for YARA rules to be tested against samples you already have
- Watch for tool-path errors; the skill asks the agent to check paths rather than guess
What people use it for
- Triage a suspicious executable in an isolated VM before deciding whether to escalate it
- Extract domains, file paths, mutexes and registry keys from a sample for a threat report
- Draft a YARA rule from strings and byte patterns shared across a sample set
- Write a Sigma rule for process injection behaviour observed in a sandbox run
- Work out why a sample exits early in a sandbox by checking anti-VM and anti-debug techniques
Frequently asked questions
How do I install the malware-analysis agent skill?
Download the ZIP from this page and unzip it. Put the malware-analysis folder in ~/.claude/skills/ for personal use, or in .claude/skills/ inside a project. In the Claude apps you can upload it under Settings → Capabilities → Skills.
Is the malware-analysis skill free?
The skill is published under the MIT licence, as stated on this page. The analysis tools it names, such as Ghidra, radare2, CAPE and floss, are separate projects with their own licences, and some sandboxes such as Joe Sandbox and ANY.RUN are commercial services.
What do I need to use this skill?
You need an agent that can load skills, the analysis tools you plan to use, and ideally an isolated VM or sandbox. The skill itself does not include any tools or a sandbox. It also references files outside its folder that are not included.
Can I run malware samples on my own computer with this skill?
The skill's workflow includes unpacking and debugger steps that can run malicious code. It should only be used in an isolated, authorised lab, not on a personal or production machine.
Why does the agent say it cannot continue with the import table?
The skill requires an import table summary before moving to dynamic analysis, unless a repair attempt failed and was recorded. If the referenced companion files or tools are missing, the agent may stop and ask you to supply them.
How is this different from a malware scanner or alternatives like a sandbox alone?
This is a set of instructions for an agent to follow, not a scanner. It guides analysis steps and depends on external tools you install. A sandbox such as CAPE produces behaviour reports, while this skill adds structured triage, rule writing and IOC classification around them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts, reverse engineers and students who already have an isolated lab and the static tools it names, and who want a consistent analysis process with evidence and rule drafting. Skip it if you need a turnkey scanner, if you lack a sandbox or isolated VM, or if you cannot read Chinese instructions comfortably.
Download the skill