How to use the Malware Config Recovery agent skill

What the skill makes the agent do

Once installed, the agent follows a structured workflow for finding where a sample stores its configuration. It looks at sections, resources, embedded archives, strings, imports and decode helpers to locate the config boundary, and it records when each value becomes plaintext.

The agent then reconstructs the decode chain in order: container, compression, encoding, XOR or substitution, crypto, and finally parsing into fields. It keeps offsets, hashes, keys and masks in one evidence block and ties each recovered field to the branch it affects, such as a beacon path, mutex, bot ID, campaign, or persistence name.

• Locate where config is stored (resource, overlay, encrypted blob, registry seed, network bootstrap or stage2 memory)
• Record the exact transform chain for each recovered field
• Correlate decoded values with PCAPs, process trees or stage2 strings when possible
• Keep original, unpacked, dumped and parsed outputs as separate artifacts

Install the skill from the ZIP or the Claude apps

Download the skill ZIP from this page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.

If you use the Claude apps, you can upload the skill under Settings → Capabilities → Skills rather than copying files by hand.

The package contains agents/openai.yaml, references/malware-config.md and SKILL.md. The main instructions are in SKILL.md, and the checklist in references/malware-config.md is loaded when the agent needs it.

Install the companion skill first

This skill is a downstream specialization. It only works properly after the companion skill ctf-sandbox-orchestrator is already active and has established sandbox assumptions. Install and activate that skill before you rely on this one.

If the orchestrator has not run, the skill tells the agent to return to ctf-sandbox-orchestrator first.

Trigger the skill with natural requests

You do not need special syntax. Ask for the outcome you want, and state that you are working in a sandbox so the orchestrator can set its assumptions first. The skill's description lists the kinds of requests it matches.

Requests that match include asking to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or link recovered config to observed protocol behaviour under sandbox assumptions.

• Recover the config from this sample; we are working in an isolated CTF sandbox.
• Decode the C2 and beacon fields in this stage2 payload.
• Unpack the staged payload and mark where each stage boundary is.
• Extract the bot ID and campaign ID and show which branch each one controls.
• Tie the recovered beacon parameters to the protocol behaviour in this PCAP.

What you need before you start

The skill assumes two things that it does not bundle: malware sample files and an isolated analysis sandbox. You must supply both yourself.

The skill runs no scripts and uses no network access of its own. It is a set of written instructions for the agent, so any tools the agent uses come from your environment and the companion skill.

• The companion skill ctf-sandbox-orchestrator must already be active
• Malware sample files, which you provide
• An isolated analysis sandbox, which you set up
• Runs scripts: no. Uses network: no.

Safety notes for scripts and network use

The skill does not enforce sandbox isolation. It assumes you are working in one. Do not use it to analyse live malware on a production or personal machine.

Because the skill itself runs no scripts and makes no network calls, any execution or connection risk comes from the tools you let the agent run. Review those before you grant them.

• Never analyse live samples on a production or personal machine
• Keep the sandbox isolated before the agent begins work
• Treat the skill as guidance; it does not police the environment

Tips for better results

Give the agent the sample context up front, including whether it is a CTF challenge or a sandbox analysis, so the orchestrator can set assumptions before decoding starts.

Ask for evidence blocks. The skill is built to keep hashes, offsets and keys together, which makes results easier to check and reproduce.

The skill replies in Simplified Chinese unless you explicitly request English, so state your language preference in the request.

• State your sandbox assumptions in the first message
• Ask for the transform chain for each field, not just the final values
• Request English explicitly if you need it