Guide · Agent skill
How to use the Cuckoo Sandbox malware analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-malware-behavior-with-cuckoo-sandbox agent skill, which teaches an AI agent to detonate a suspicious sample in Cuckoo Sandbox and summarize the resulting behavioral report. It is written for security analysts and students who already have a sample past initial triage and a dedicated analysis environment. By the end you will know how to install the skill, phrase a request that triggers it, and what the agent will check and produce.
Malware Behavior Analysis with Cuckoomukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Or upload it in the Claude apps. In the Claude apps, open Settings → Capabilities → Skills and upload the skill.
- 3Prepare the Cuckoo environment. Confirm Cuckoo Sandbox 3.x, Windows guest VMs with the Cuckoo agent, and isolated networking with InetSim or FakeNet-NG are running.
- 4Verify network isolation. Check that the analysis network is isolated before any sample is submitted, as the skill requires.
- 5Ask for an analysis in plain language. Describe the sample path and the output you need, such as an IOC list or classification.
- 6Review the report. Check the process tree, network activity, dropped files, registry changes and triggered signatures the agent summarizes.
What the skill makes the agent do
Agent skills are folders of instructions and optional scripts that an AI agent loads when a request matches the skill's description. This one covers dynamic analysis: running a malware sample inside Cuckoo Sandbox, an open-source tool that launches the file in a virtual machine and records its activity.
After the run, the agent reads the report and works through process activity, suspicious API calls, network traffic, dropped files, registry changes and triggered behavioral signatures. It then summarizes these into a classification and indicators of compromise, and can draft YARA-style signature ideas from what it observed.
- Submits a sample or URL to Cuckoo and checks task status
- Parses the JSON report for process trees, network activity, dropped files and registry keys
- Lists triggered signatures with severity and the Cuckoo threat score
- Points to the memory dump and PCAP for deeper analysis with Volatility or Wireshark
Install the skill with a ZIP or the Claude apps
Download the skill ZIP from this page and unzip it. For Claude Code, place the skill folder in ~/.claude/skills/ for your user account, or in .claude/skills/ inside a specific project if you want it limited to that project.
In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills. The skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.
- Personal: ~/.claude/skills/
- Project-specific: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
Check the requirements before you run anything
The skill assumes a working Cuckoo Sandbox 3.x installation on a dedicated Ubuntu server, with Windows 10/11 guest VMs that have the Cuckoo agent installed and snapshots taken at a clean state. The guest can run under VirtualBox, KVM or VMware.
Network isolation is a hard requirement. The source recommends InetSim or FakeNet-NG to simulate internet services and Suricata or Snort for network-level signature matching. scripts/agent.py uses Python with the requests library, and roughly 500 GB of disk is recommended for captures and memory dumps.
- Cuckoo Sandbox 3.x on a dedicated analysis server
- Windows 10/11 guest VMs with the Cuckoo agent and clean snapshots
- VirtualBox, KVM or VMware as the virtualization backend
- InetSim or FakeNet-NG and Suricata or Snort for isolated networking
- Python with the requests library
- About 500 GB of disk space recommended
Trigger the skill with a natural request
You do not need to name the skill. Ask for behavioral analysis in plain terms, and mention the sample and what you need back. The skill's description points to cases where a sample has passed static triage, when you need to map an infection chain, or when you want signatures built from sandbox activity.
Give the agent the file path and the output you want, such as an IOC list or a classification. Be explicit that the sandbox is isolated, because the skill tells the agent to verify isolation first and will not treat a normal machine as safe.
- Example: "Detonate /samples/invoice.exe in our Cuckoo sandbox and list the IOCs from the report."
- Example: "Parse the Cuckoo report for task 4 and tell me which signatures fired and why."
- Example: "Draft YARA-style ideas from the behavior of this sample, based only on the sandbox output."
Example commands the skill draws on
The skill uses the Cuckoo command line and REST API. Submitting a file with a timeout and a chosen VM looks like this, and the agent can run equivalent calls for you. Check task status on the REST API with the task ID returned on submission.
The report is read from the analysis storage folder, and the PCAP is saved alongside it. The skill also lists the Volatility commands it uses on the memory dump.
- Status values in the API are pending, running, completed and reported
cuckoo submit --machine win10_x64 --package exe --timeout 300 /path/to/suspect.exe
curl -F "file=@suspect.exe" -F "timeout=300" http://localhost:8090/tasks/create/file
curl http://localhost:8090/tasks/view/1 | jq '.task.status'Safety notes: scripts and network
This skill runs scripts and uses the network. Live malware must only run inside a network-isolated analysis environment. Running it on a normal machine can infect that machine or spread to a network.
Do not use the skill on known ransomware that may spread through network shares if the sandbox is misconfigured. Confirm isolation before submitting any sample, and review any script the agent proposes to run.
- Use only a dedicated, network-isolated Cuckoo server
- Verify isolation before the first submission
- Be cautious with known ransomware and network share spread
- Review scripts/agent.py before running it
Tips for consistent reports
Take clean snapshots of each guest VM before analysis so every run starts from the same state. Ask the agent to use the same machine, package and timeout across a batch so the reports are comparable.
Treat the agent's classification as a draft. Check the signatures, marks and IOCs against the raw report before you act on them.
- Use the same VM, package and timeout for batch samples
- Compare the threat score with the signatures that fired
- Keep the PCAP and memory dump for follow-up work
What people use it for
- Producing a consistent behavioral report across a batch of samples that have passed triage
- Mapping a second-stage download and persistence mechanism from network and registry activity
- Drafting an IOC list of domains, IPs and dropped file hashes for a detection team
- Learning dynamic malware analysis by reviewing how Cuckoo reports API calls and signatures
Frequently asked questions
Is the Cuckoo Sandbox malware analysis skill free?
The skill is licensed under Apache-2.0, as listed on this page. Cuckoo Sandbox is an open-source tool, but you still need your own server, Windows guest VMs and isolated network tools to run it.
What do I need to run this agent skill?
You need Cuckoo Sandbox 3.x on a dedicated Ubuntu server, Windows 10/11 guest VMs with the Cuckoo agent, VirtualBox, KVM or VMware, InetSim or FakeNet-NG, Suricata or Snort, and Python with the requests library. About 500 GB of disk is recommended.
Where do I install a skill for Claude Code?
Place the skill folder in ~/.claude/skills/ for your user account, or in .claude/skills/ inside a project to limit it to that project.
How do I install the skill in the Claude apps?
Upload the skill under Settings → Capabilities → Skills. Make sure the uploaded folder includes SKILL.md, scripts/agent.py and references/api-reference.md.
Is it safe to run malware with this skill?
Only inside a dedicated, network-isolated analysis server. The skill says to verify isolation first and warns against using it on known ransomware if the sandbox might spread it through network shares.
How does this compare with running Cuckoo by hand?
The skill does not replace Cuckoo. It drives Cuckoo and turns the JSON report into a summary of processes, network activity, signatures and IOCs. You still need to set up and maintain the sandbox yourself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts and students who already run an isolated Cuckoo Sandbox and want consistent behavioral summaries across many samples. It is a poor fit for anyone without a dedicated, network-isolated analysis server or without the expertise to build and maintain one.
Download the skill