Skip to content
Get packs

JavaScript Malware Deobfuscator

Unpacks obfuscated malicious JavaScript from phishing pages and skimmers to reveal its logic

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill guides an AI agent through reverse-engineering obfuscated JavaScript found in phishing pages, web skimmers, and droppers. The agent extracts script tags from HTML, beautifies the code, identifies encoding tricks such as hex, base64, and fromCharCode, decodes string layers, and works through eval chains to expose the original malicious behavior. A bundled Python helper (scripts/agent.py) performs beautifying and pattern-based decoding of these encodings.

Great for

  • Security analysts triaging a suspicious phishing page or email HTML attachment
  • Incident responders investigating a Magecart-style skimmer on an e-commerce site
  • Malware researchers who want a repeatable first pass at decoding obfuscated scripts

Skip it if

  • Simply minified production JavaScript, where a standard beautifier is enough (the skill itself says so)
  • Running untrusted samples on a normal workstation: the skill assumes an isolated VM, and executing malicious JavaScript can compromise the host or leak data
  • Non-security readers looking for general JavaScript formatting or code cleanup

Try asking

  • “Extract and beautify the script tags from malicious_page.html and summarize what they do”
  • “Decode the hex and base64 strings in this skimmer script and list the domains it contacts”
  • “Identify the obfuscation techniques used in this dropper and outline the second-stage download logic”
Step-by-step guide: how to use JavaScript Malware DeobfuscatorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    deobfuscating-javascript-malware.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deobfuscating-javascript-malware.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deobfuscating-javascript-malware.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always run the analysis inside an isolated VM with no access to production systems or real credentials, since samples are live malware.
  • Review scripts/agent.py before running it, and treat any sample-handling step as executing untrusted input.
  • Ask for the decoded output to be saved to files so you can inspect each layer yourself rather than relying only on the agent's summary.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.