Guide · Agent skill
How to use the Supply Chain Malware Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-supply-chain-malware-artifacts agent skill, a structured playbook that tells an AI agent how to investigate supply chain attacks, where trusted software updates, build pipelines or open-source packages are tampered with. It is written for security analysts and incident responders, and you should be comfortable reading their output. By the end you will know what the skill does, how to install it, how to phrase a request that triggers it, and where its limits are.
Supply Chain Malware Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Or upload it in the Claude apps. Go to Settings → Capabilities → Skills and upload the ZIP.
- 3Install the prerequisites. Install Python 3.9+, pefile, ssdeep, requests, and a code signing tool suited to your OS.
- 4Obtain a legitimate reference copy. Get a known-good version of the software from a trusted source to compare against.
- 5Ask for the investigation in plain language. Describe the suspect artifact, the clean reference, and the output you need.
- 6Review the results in an isolated lab. Run any scripts on copies of the samples and check the report for IOCs and timeline gaps.
- 7Have an expert confirm the conclusion. Use the IOCs and recommendations as input to a professional incident response process.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one, named analyzing-supply-chain-malware-artifacts, covers suspected trojanized software updates, compromised build pipelines and sideloaded dependencies, with the goal of identifying the intrusion vector and the scope of compromise.
Once loaded, the agent follows a workflow: it compares a suspicious program against a known-legitimate version, looks at sections, imports and code signing, checks npm package metadata, and organizes results into indicators of compromise (IOCs) and an infection timeline. The skill includes an analysis report template with fields for SHA-256, file type, findings, IOCs and recommendations.
- Binary comparison of PE files: section sizes and entropy, new sections, and new imports against a legitimate copy
- Hash calculation with MD5, SHA-1 and SHA-256
- Code signing checks for the suspect and legitimate files
- npm and PyPI registry metadata lookups
- A report template with Findings, IOCs Extracted and Recommendations tables
Install the skill from a ZIP download
Download the ZIP for this skill from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder so it applies only to that project.
If you use the Claude apps instead of Claude Code, upload the ZIP under Settings → Capabilities → Skills. The skill's license is Apache-2.0.
- Personal: ~/.claude/skills/analyzing-supply-chain-malware-artifacts/
- Project only: .claude/skills/analyzing-supply-chain-malware-artifacts/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
~/.claude/skills/analyzing-supply-chain-malware-artifacts/Install the required tools before you run the scripts
The skill's workflow needs Python 3.9 or newer with the pefile, ssdeep and hashlib libraries, and the requests library for the npm/PyPI helper script. Binary diff tools (BinDiff or Diaphora) are optional. For code signing checks you need sigcheck or codesign, depending on your operating system. You also need a known-legitimate copy of the software you are comparing against.
The npm check needs internet access to registry.npmjs.org. The skill's scripts run locally, and the helper script uses the network, so review what it does before running it.
- Python 3.9+ with pefile, ssdeep, hashlib
- requests library (npm/PyPI helper script)
- BinDiff or Diaphora (optional)
- sigcheck (Windows) or codesign (macOS) for code signing
- A known-legitimate copy of the software
- Network access to registry.npmjs.org for the npm check
Trigger the skill with natural requests
You do not need a special command. Describe the investigation in plain language and mention the artifact and the goal. The agent matches your request to the skill's description and loads it. Name the files you have so the agent knows what to compare.
Good requests state a suspect file, a clean reference, and what you need back, for example an IOC list or a timeline. Vague requests such as 'is this safe' are less likely to produce a useful structured investigation.
- Compare suspect.exe against the clean 2.4 installer I have and list new sections and imports.
- Check the npm package example-lib for signs of tampering and summarize the registry metadata.
- Build an infection timeline and IOC table from these build artifacts for my incident report.
- Fill in the analysis report template for this sample with SHA-256, findings and recommendations.
Run the comparison script on your own samples
The skill includes scripts/agent.py and a binary comparison example. The comparison example takes two arguments: a legitimate binary and a suspect binary, and prints a JSON report. It flags sections that are new or whose size changed by more than 1024 bytes, lists new imports, and reports whether each file has a signature directory entry.
Run it only in an isolated lab on copies of the files, not on a production machine.
python3 compare.py <legitimate_binary> <suspect_binary>Safety notes before you analyze anything
The skill does not provide sandboxing. Suspect binaries should be handled in an isolated lab, not on the machine you use day to day. The skill runs scripts and uses the network, so read scripts/agent.py before execution and understand what it sends.
Treat the agent's output as an aid for expert review. A wrong conclusion can lead to wrongly clearing or wrongly condemning software, so verify important findings with your own tools and experience.
- Use an isolated lab for live or suspect samples
- Read scripts/agent.py before running it
- The npm check contacts registry.npmjs.org
- Confirm any verdict with a qualified analyst
What people use it for
- Comparing a trojanized installer against a clean release to find new sections and imports
- Checking npm package metadata during a suspected dependency compromise
- Organizing findings from a SolarWinds- or 3CX-style investigation into IOCs and a timeline
- Producing a structured analysis report using the included template
- Writing a repeatable checklist for threat hunting on supply chain techniques
Frequently asked questions
Is the Supply Chain Malware Analyzer skill free?
The skill is licensed under Apache-2.0, as stated in its metadata. Check the license file in the downloaded ZIP for the full terms before reuse.
What do I need to install before using this skill?
You need Python 3.9 or newer with pefile, ssdeep and hashlib, plus the requests library for the npm/PyPI helper. Optional tools include BinDiff or Diaphora, and sigcheck or codesign for signature checks. You also need a known-legitimate copy of the software.
Where do I put the skill folder?
Place it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder for one project. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
Does this skill scan my npm dependencies for vulnerabilities?
No. It is a forensic investigation workflow for suspected trojanized software, not a dependency scanner. For routine dependency checks, use a software composition analysis tool instead.
Can I run this on a suspicious file on my work laptop?
The skill does not provide sandboxing, so analysis of live malicious samples should happen in an isolated lab, not on a production machine.
Does the skill replace an incident response team?
No. It structures the investigation, but its output still needs expert review, and a wrong conclusion could lead to bad decisions.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts, incident responders and security engineers who already understand malware analysis and want a repeatable checklist for suspected trojanized software. It is a poor fit for people without that background, for routine package installs, or for running untrusted samples outside an isolated lab. Choose a commercial dependency scanner or a dedicated sandbox when your need is different.
Download the skill