Guide · Agent skill
How to use the Ransomware Canary File Deployer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Ransomware Canary File Deployer is an agent skill that sets up decoy files, called canary files, in folders ransomware tends to scan first, then watches them and raises an alert the moment anything touches them. It is aimed at security and IT staff who want early warning on file servers, NAS devices or endpoints. By the end of this guide you will know what the skill does, how to install it, how to ask the agent for it, and what to check before running it.
Ransomware Canary File Deployermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the skill ZIP from this page and unzip it. Keep the folder structure intact.
- 2Place the skill folder. Move the unzipped folder into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. Alternatively, upload it in the Claude apps under Settings → Capabilities → Skills.
- 3Install Python requirements. Make sure Python 3.8+ and pip are available, then run pip install watchdog. Add requests and psutil if you want Slack alerts and process information.
- 4Prepare alert credentials. Have your SMTP server credentials or Slack webhook URL ready, and a syslog or SIEM endpoint if you use one.
- 5Ask the agent to deploy canaries. Describe the folders to protect and the alert channels you want in plain language. The agent will match your request to this skill.
- 6Run a simulated test. Ask the agent to simulate ransomware behavior on the canaries and confirm alerts arrive on every channel you configured.
- 7Keep the monitor running. Leave the monitoring process running in a long-lived session, and verify canary integrity periodically.
What the skill makes the agent do
An agent skill is a folder of instructions and scripts that an AI agent loads when your request matches the skill's purpose. This skill's source describes four stages: generate canary files, deploy a filesystem monitor, configure an alert pipeline, and validate the setup by simulating ransomware-like changes.
Canary files are named to look valuable, such as Passwords.xlsx or backup_credentials.csv, and contain plausible but fake data. Because no legitimate user or process should ever open them, any interaction is treated as a high-confidence sign of ransomware or unauthorized access.
- Creates decoy files in directories such as user desktops, Documents folders, network share roots and backup paths
- Watches them with Python's watchdog library, which uses OS-native file event APIs
- Reacts to modified, deleted, moved and created events on canary files
- Sends alerts by email over SMTP, Slack webhook, syslog to a SIEM, and to a local log file
Install the skill (ZIP download or Claude apps upload)
Download the skill ZIP from this page and unzip it. You can then place the skill folder in one of two locations: your personal skills folder at ~/.claude/skills/, or a project-specific .claude/skills/ folder inside the project you are working in.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. Use whichever method matches how you work; the skill's contents are the same either way.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
Install the Python requirements
The skill needs Python 3.8 or later with pip. Install the watchdog library, which the skill uses for filesystem monitoring. The source lists requests and psutil as optional libraries: requests supports Slack webhook calls, and psutil supplies process information when canary access is detected.
- Required: Python 3.8+ and pip
- Required: watchdog library
- Optional: requests and psutil
- Optional: a SIEM or syslog server
pip install watchdogAsk the agent to deploy and monitor canaries
You do not need to type a special command. Describe the outcome in plain language and mention the folders you want covered, for example asking the agent to place canary files in a finance share and watch them for changes. The agent should match your request to this skill because its description covers ransomware early-warning detection on file servers, NAS devices and endpoints.
The skill's reference lists functions the agent can work with, including deploy_canary_files, start_monitoring, verify_canary_integrity and simulate_ransomware_test. You do not need to call these yourself to use the skill, but they show what the scripts can do.
- Name the folders to cover, such as a shared drive or home directories
- State where alerts should go: email, Slack or syslog
- Ask for a test run first if you want to confirm alerts arrive before relying on them
Example outcomes you can ask for
Each example below describes the result you would expect from the skill's workflow. Confirm the details against the scripts and your own environment before you rely on them.
- Place decoys named like passwords or financial reports in the Documents folders of a file server, then watch them and alert on any read, change, rename or delete
- Add canaries to a NAS backup volume and send alerts to a Slack channel
- Check that canary files are still intact and report any that are modified or missing
- Run a simulated ransomware test to confirm that the alert pipeline fires across the channels you configured
Safety notes: scripts and network access
This skill runs scripts and uses the network. The alert pipeline sends data to an SMTP server, a Slack webhook or a syslog server, so you need credentials or endpoints you are allowed to use. Review scripts/agent.py before running it, and confirm where alert data is being sent.
Canary files only detect activity after it has started. Keep backups and endpoint controls in place. Also plan for decoys being found and mistaken for real credentials, since that can cause confusion or misuse unless your team has prepared for it.
- Requires SMTP credentials and/or a Slack webhook URL for alerts
- Requires write access to target directories and admin rights for system directories
- Uses network access for alert delivery
- Not a replacement for antivirus, backups or network segmentation
Tips for a reliable setup
Test before you trust the setup. The source recommends simulating ransomware behavior by modifying, renaming and deleting canary files, then measuring time-to-alert and checking delivery on every channel. Keep the monitor running in a long-lived process, because canaries cannot alert while nothing is watching them.
Place canaries where ransomware scanners look first, but make sure no legitimate workflow touches them. Each alert payload includes the event type, file path, timestamp and process information when available, which helps you triage quickly.
- Run the simulated test after every change to canary locations or alert settings
- Use the local log file as a record even when email or Slack is delayed
- Keep a list of canary file paths so you can verify they are still intact
What people use it for
- Early-warning detection on a shared finance drive, where decoys are placed in the folder root and alerts go to a security channel
- Adding a detection layer to a NAS or backup volume that cannot run an endpoint agent
- Covering systems where EDR cannot be installed, as a lightweight supplement
- Practicing ransomware incident response in a lab by triggering canary alerts on purpose
Frequently asked questions
Is the Ransomware Canary File Deployer skill free?
The skill is published under the Apache-2.0 licence, as stated in its source. Check the licence text for the terms that apply to your use. Your costs may still include your own email, Slack or SIEM services.
What do I need to run the canary file skill?
You need Python 3.8+ with pip, the watchdog library, write access to the directories where canaries will go, and admin rights for system directories. You also need SMTP credentials or a Slack webhook URL for alerts. requests, psutil and a SIEM or syslog server are optional.
How do I install the skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does this stop ransomware?
No. Canary files are a detection layer. They alert once activity has started, so you still need backups, endpoint protection and network segmentation. The source is explicit that this skill is not a replacement for those controls.
How is this different from EDR or antivirus?
The skill does not block or remove malware. It watches decoy files with watchdog and alerts on any interaction. It is meant to supplement EDR on systems where an agent cannot be installed, such as some file servers or NAS devices.
Why is the agent not alerting?
Check that the monitoring process is still running, that the canary paths exist and are watched, and that your SMTP, Slack or syslog settings are correct. Running the simulated ransomware test will show which channel is failing.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security or IT person who wants a low-cost early-warning layer on file servers, NAS devices or systems where EDR cannot run, and you can supply alert credentials and a long-running Python process. Pick something else if you need prevention, if you cannot have decoys mistaken for real credentials, or if you lack admin rights and a place to run the monitor.
Download the skill