Skip to content
Get packs

Guide · Agent skill

How to use the Malware Incident Response agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The conducting-malware-incident-response skill gives an AI agent a structured playbook for suspected malware infections on enterprise endpoints, covering trojans, worms and ransomware. It is written for security analysts, IT responders, small security teams and students who want a consistent incident checklist. After reading this guide you will know how to install the skill, how to ask for it in plain language, what it needs to run, and which steps should stay under human control.

Malware Incident Responsemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Get the skill ZIP from this page.
  2. 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use or .claude/skills/ in a project.
  3. 3Or upload in the Claude apps. Go to Settings → Capabilities → Skills and upload the ZIP.
  4. 4Prepare Python and keys. Install Python 3 with the requests library and get a VirusTotal API key if you want reputation lookups.
  5. 5Describe the incident. Ask in plain language, giving the alert name, file path, hash or symptoms.
  6. 6Review every containment step. Have a staff member approve isolation, account changes and reimaging before they happen.

What the skill makes the agent do

An agent skill is a folder of instructions and optional scripts that an AI agent loads when a task matches the skill's description. This one applies when a malware infection is confirmed or suspected, including trojan, worm and ransomware outbreaks, malware triage, and infected endpoint remediation.

Once loaded, the agent follows a six-step workflow: confirm the alert, scope the infection, contain affected systems, analyse the malware, eradicate it, and recover and validate. It maps findings to MITRE ATT&CK techniques and suggests tools such as EDR platforms, sandboxes like ANY.RUN or Joe Sandbox, and VirusTotal.

  • Step 1: Detect and confirm, using EDR details, file hashes and reputation lookups
  • Step 2: Scope, searching all endpoints for the hash, filename and behaviour
  • Step 3: Contain, by isolating hosts and blocking C2 infrastructure
  • Step 4: Analyse, documenting persistence, artifacts and network indicators
  • Step 5: Eradicate, removing processes, files and persistence mechanisms
  • Step 6: Recover, reconnecting systems in stages and monitoring for 72 hours

Install the skill from the ZIP download

Download the ZIP for this skill from this page. You can add it to your personal skills folder, to a single project, or upload it through the Claude apps.

For a personal install, unzip the download into ~/.claude/skills/. For a project-only install, unzip it into the project's .claude/skills/ folder. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

  • Personal: ~/.claude/skills/
  • Project: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up the requirements before you run the script

The skill's bundled script, scripts/agent.py, needs Python 3 and the requests library. The API reference lists requests as the only package dependency. The reputation lookup also needs a VirusTotal API key.

Enterprise tools are recommended but the files do not require them. The instructions assume an EDR platform, a sandbox such as ANY.RUN or Joe Sandbox, and forensic tools such as FTK Imager or KAPE. If you do not have these, you can still use the checklist and the ATT&CK mapping, but you will not be able to carry out many of the steps.

  • Python 3 with the requests library
  • A VirusTotal API key for hash lookups
  • Recommended: EDR platform, malware sandbox, forensic imaging tools

How to trigger the skill with natural requests

You do not need to name the skill. Describe the situation in plain language and mention the infection, the affected machine or the file. The agent should match the request to the skill's description and follow the workflow.

Give the agent the facts it needs: the alert name, the file path, the hash if you have it, and what the user saw. Asking for a specific step, such as scoping or ATT&CK mapping, also works.

  • "Our EDR flagged update.exe on a finance laptop. Walk me through confirming and scoping the infection."
  • "Triage this SHA-256 and tell me which ATT&CK techniques the behaviour matches."
  • "Help me write incident notes for an infected endpoint we have just reimaged."
  • "Three hosts may have a ransomware outbreak. Give me a containment checklist for staff to approve."

Run the bundled script for hash and reputation checks

The script can hash a sample file and query VirusTotal for detection stats and classification, which speeds up triage. The API reference also documents a command-line form that accepts an incident ID, a sample file, the VirusTotal key and output file, plus optional CrowdStrike and device parameters. The output is written to a JSON report.

Use a placeholder-free command only with your own values in place of the angle-bracket fields. Keep API keys out of shared logs and chat transcripts.

  • Inputs: incident ID, sample file, VirusTotal key, output file
  • Output: a JSON report file
python agent.py --incident-id INC-001 --sample malware.exe --vt-key <key> --cs-token <token> --device-id <id> --output report.json

Safety notes: scripts and network access

This skill runs scripts and uses the network. The API reference describes lookups against VirusTotal, MalwareBazaar and ThreatFox, and a CrowdStrike isolation function that takes a token and device ID. Isolating a host can disrupt users, so treat any isolation or account change as a decision for a staff member to approve.

The skill itself says that reverse engineering and deep malware research belong in dedicated analysis procedures, not in this workflow. Read the script before running it on a production system.

  • Do not run containment steps on production hosts without human review
  • Keep VirusTotal and CrowdStrike credentials private
  • Use dedicated malware analysis procedures for research on samples

What people use it for

  • Triaging an EDR alert on a single endpoint to decide whether it is a known family or a generic heuristic detection
  • Scoping a suspected phishing outbreak by listing where a delivery email went and which hosts show the same hash
  • Drafting incident notes and ATT&CK technique mappings for a small security team
  • Teaching the typical stages of malware incident response to students

Frequently asked questions

How do I install the conducting-malware-incident-response skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

What do I need to run the malware incident response skill?

You need Python 3 with the requests library for the bundled script, and a VirusTotal API key for the reputation lookup. EDR, sandbox and forensic tools are recommended by the instructions but the files do not require them.

Is the malware incident response skill free?

The skill is licensed under Apache-2.0, as stated on this page. Check the VirusTotal terms for your own API key, since the skill does not include one.

Why does the script fail when I run it?

Check first that Python 3 and the requests library are installed, that your VirusTotal key is valid, and that the machine has network access. Then confirm the file paths you passed to the script exist.

Can the agent isolate infected computers on its own?

The API reference describes a CrowdStrike isolation function that needs a token and device ID. The skill says containment steps can disrupt business and should be approved by staff, so do not let them run unattended on production hosts.

Does this skill replace a trained incident responder or malware analyst?

No. The skill says it is not a substitute for a trained responder during a live breach and points deep malware research to dedicated analysis procedures. Use it as a consistent checklist and note-taking aid.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security analysts, IT responders on small teams and students who want a consistent, ATT&CK-mapped checklist for suspected endpoint infections. It is a poor fit for reverse engineering, live breach response without experienced staff, or users with no access to EDR or forensic tools, where a dedicated analysis or incident response service is the better choice.

Download the skill