Supply Chain Malware Analyzer
Guides an agent through checking software supply chain attacks: comparing trojanized binaries and checking package registries.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 6 files
What it does
This skill gives an AI agent a structured playbook for investigating supply chain attacks, where criminals tamper with trusted software updates, build systems, or open-source packages. Once installed, the agent knows how to compare a suspicious program against a known-good version (looking at sections, imports, and code signing), check npm package metadata, and organize findings into indicators of compromise and an infection timeline. It is written for security analysts and does not replace professional incident response.
Great for
- SOC analysts and incident responders who need a repeatable checklist for suspected trojanized software
- Security engineers building detection or threat-hunting coverage for supply chain techniques
- Students learning how SolarWinds- or 3CX-style attacks are investigated
Skip it if
- People without malware analysis experience: the output still needs expert review, and a wrong conclusion could lead to bad decisions (for example, wrongly clearing or wrongly condemning software)
- Running analysis on live malicious samples on a production machine: the skill does not provide sandboxing, and handling suspect binaries should happen in an isolated lab
- Verifying a simple package install for everyday development: this is a forensic investigation workflow, not a dependency scanner
Try asking
- “Compare this suspect DLL with the legitimate version from the vendor and list new imports and sections”
- “Check whether the npm package my project depends on has unexpected maintainer changes”
- “Help me build a timeline of how this trojanized installer reached our endpoints”
- “List the IOCs I should extract from this supply chain incident”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 6 original files, the Apache-2.0 licence and an attribution note.
analyzing-supply-chain-malware-artifacts.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-supply-chain-malware-artifacts.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-supply-chain-malware-artifacts.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the analysis on a copy inside an isolated lab VM, never on a production host, because the agent will parse untrusted binaries.
- Always compare against a verified legitimate version from the vendor; the comparison is only as good as the baseline.
- Read scripts/agent.py before running it: the file is only partly shown in the materials, and the npm/PyPI helper makes outbound requests to public registries.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.