Skip to content
Get packs

PDF Malware Triage with PDFiD

Lets the agent statically scan suspicious PDFs for embedded scripts, launch actions and payloads without opening them.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this skill gives the agent a structured method for examining a suspicious PDF file without opening it in a viewer. The agent runs or describes PDFiD, pdf-parser and peepdf to look for risky elements such as embedded JavaScript, auto-run actions, embedded files and object streams, then extracts those pieces for further analysis. It also includes a small Python script that counts suspicious PDF keywords and computes file hashes.

Great for

  • Security analysts triaging phishing attachments flagged by email security
  • Incident responders who need a repeatable first-pass checklist for PDF samples
  • Students learning static analysis of document malware

Skip it if

  • Viewing or summarizing the visual content of a PDF, which the skill explicitly says it is not for
  • Running on a machine with a PDF reader or sensitive data, since samples are malicious and the skill assumes an isolated analysis VM
  • Final verdicts on maliciousness: keyword counts are heuristic and can produce false positives and negatives

Try asking

  • “Triage this suspicious invoice.pdf attachment and tell me whether it contains JavaScript or auto-open actions”
  • “Run a PDFiD-style keyword scan on this sample and summarize the risk indicators”
  • “Extract the embedded JavaScript objects from this PDF for review in an isolated VM”
  • “Hash this PDF and list any embedded files that could be executables”
Step-by-step guide: how to use PDF Malware Triage with PDFiDInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-pdf-malware-with-pdfid.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-pdf-malware-with-pdfid.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-pdf-malware-with-pdfid.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the analysis inside an isolated VM with no PDF reader installed, since malicious samples may execute when opened
  • Treat PDFiD keyword hits as leads to investigate with pdf-parser rather than as proof of malware
  • Review agent.py before running it, because the excerpt shown is truncated and its full behaviour was not confirmed

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.