{
  "$schema": "https://readbeforerun.ai/schema/entry.schema.json",
  "entry": {
    "id": "tomabai-malware-analyst",
    "name": "Malware Analyst",
    "summary": "Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.",
    "draft": "review",
    "type": "skill",
    "mission": [
      "defensive"
    ],
    "task": [
      "malware-reversing",
      "detection-engineering"
    ],
    "domain": [
      "security-operations"
    ],
    "runtime": [
      "claude-code"
    ],
    "tier": "listed",
    "last_checked": "2026-10-21",
    "next_check": "2027-01-19",
    "freshness": "fresh",
    "superseded": false,
    "in_my_kit": null,
    "advice": null,
    "code_shows": "runs shell commands or eval · Secrets: unknown",
    "source": {
      "repo": "https://github.com/tomabai/malware-analyst",
      "subpath": null,
      "commit": "da852e499faad38a539d43b6000bd4bc8d0b11b9",
      "version": null,
      "license": "MIT"
    },
    "install": {
      "skills_cli": null,
      "claude_code": null,
      "upstream": "Place the `malware-analyst/` directory (containing `SKILL.md`) in your `~/.claude/skills/` directory",
      "bundled": false
    },
    "scan": {
      "status": "static scan pending (not run)"
    },
    "reach": {
      "method": "reach-v0.1",
      "level": 2,
      "level_source": "static",
      "level_label": "open",
      "unknown_axes": 1,
      "verdict": "not-run",
      "badge": "reach ≥2 · not run yet",
      "long": "reach ≥2 from code (open, 1 right unknown); lab: not run yet",
      "declared": {
        "exec": 0
      },
      "static": {
        "level": 2,
        "fs": 1,
        "net": 0,
        "exec": 2,
        "cred": null,
        "persist": 0,
        "hitl": 0,
        "unknown": [
          "cred"
        ]
      },
      "observed": null,
      "surplus": null,
      "fit": null,
      "exports": {
        "aivss": {
          "fs": 0.5,
          "net": 0,
          "exec": 0.5,
          "cred": null,
          "persist": 0,
          "hitl": 0
        },
        "usf_risk_tier": "L2"
      }
    },
    "profile": {
      "read_at": "da852e499faad38a539d43b6000bd4bc8d0b11b9",
      "read_on": "2026-10-25",
      "overview": "A static malware analysis skill that deobfuscates and reverse-engineers suspicious files and writes detection signatures for them.",
      "purpose": [
        "Deobfuscates suspicious files layer by layer, explains what the code does, extracts indicators of compromise and writes variant-agnostic detection signatures.",
        "Meant for files a user shares as suspicious, obfuscated scripts, and samples of named families such as Sandworm, Agent Tesla and malOpenclaw.",
        "Produces indicators of compromise as concrete artifacts for detection and incident response."
      ],
      "use_cases": [
        {
          "text": "Deobfuscate an obfuscated script or dropper layer by layer (base64, hex, XOR, eval/exec wrappers, custom ciphers) and show each layer.",
          "task": "malware-reversing"
        },
        {
          "text": "Extract network, filesystem, behavioural and cryptographic IOCs from a sample, each tagged with a confidence level.",
          "task": "dfir"
        },
        {
          "text": "Write text-based signatures for grep, YARA strings or SIEM rules.",
          "task": "detection-engineering"
        },
        {
          "text": "Triage a compiled binary by noting its format, extracting readable strings and imports, and flagging suspicious API calls.",
          "task": "malware-reversing"
        }
      ],
      "maturity": null,
      "capabilities": [
        {
          "name": "Phase 1: Initial Triage",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "Phase 2: Full Deobfuscation",
          "effects": [
            "reads",
            "changes",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Phase 3: Behavioral Analysis",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "Phase 4: IOC Extraction",
          "effects": [
            "reads",
            "changes",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Phase 5: Detection Signatures",
          "effects": [],
          "enabled": "default"
        },
        {
          "name": "Phase 6: Threat Summary",
          "effects": [],
          "enabled": "default"
        }
      ],
      "effects": [
        "reads",
        "changes",
        "runs-commands"
      ],
      "runs": "in-client",
      "listens": [],
      "sends_to": [],
      "model": "client",
      "needs": [
        {
          "kind": "runtime",
          "text": "Claude Code as the AI client."
        },
        {
          "kind": "tools",
          "text": "node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor."
        }
      ]
    },
    "urls": {
      "page": "/catalog/tomabai-malware-analyst/",
      "json": "/entries/tomabai-malware-analyst.json",
      "md": "/catalog/tomabai-malware-analyst.md",
      "badge": "/badge/tomabai-malware-analyst.svg"
    }
  },
  "data": {
    "schema_version": "0.5",
    "slug": "tomabai-malware-analyst",
    "name": "Malware Analyst",
    "summary": "Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.",
    "draft": "review",
    "in_my_kit": null,
    "type": "skill",
    "mission": [
      "defensive"
    ],
    "task": [
      "malware-reversing",
      "detection-engineering"
    ],
    "domain": [
      "security-operations"
    ],
    "phase": [
      "def:detect",
      "def:respond"
    ],
    "role": [
      "soc",
      "dfir"
    ],
    "runtime": [
      "claude-code"
    ],
    "auth": null,
    "autonomy": null,
    "addresses": [],
    "frameworks": {
      "owasp_ast": [],
      "owasp_asi": [],
      "attack_tactic": [],
      "atlas": []
    },
    "source": {
      "repo": "https://github.com/tomabai/malware-analyst",
      "commit": "da852e499faad38a539d43b6000bd4bc8d0b11b9",
      "license": "MIT",
      "manifest": "SKILL.md",
      "also_listed": {
        "tenable-cyberagents-exchange": "https://github.com/tenable/cyberagents-exchange/blob/9d0ddf1fe8dc9651a0c461a2a27d33cb8a160a2c/skills/malware-analyst.md"
      }
    },
    "upstream": {
      "checked_at": "2026-10-21",
      "updated_at": "2026-07-12",
      "current_release": null,
      "archived": false,
      "stars": 10,
      "commit_history": {},
      "releases_since_pin": 0
    },
    "install": {
      "upstream": "Place the `malware-analyst/` directory (containing `SKILL.md`) in your `~/.claude/skills/` directory",
      "upstream_evidence": "README.md#L22",
      "bundled": false
    },
    "scan": [
      {
        "tool": "cisco-skill-scanner",
        "version": "not-run",
        "llm_judge": false,
        "date": "2026-10-21",
        "result": "pending"
      }
    ],
    "privileges": {
      "method": "reach-v0.1",
      "declared": {
        "axes": {
          "exec": 0
        },
        "evidence": {
          "exec": "README.md#L18 the author declares static analysis only and that the file under analysis is never executed"
        }
      },
      "static": {
        "level": 2,
        "axes": {
          "fs": 1,
          "net": 0,
          "exec": 2,
          "cred": null,
          "persist": 0,
          "hitl": 0
        },
        "evidence": {
          "fs": "SKILL.md#L65 the agent writes a new standalone decryptor file, and no path outside the working directory is named",
          "net": "none found: patterns net-v0.1 in 1 files at da852e4",
          "exec": "SKILL.md#L68 the agent runs decryptor scripts it writes itself with node or uv run python, and line 65 has it copy the cipher code for them verbatim from the sample",
          "cred": "no evidence: the skill text shows no access to credentials, but the search patterns for secrets match 3 lines, so a zero cannot be written",
          "persist": "none found: patterns persist-v0.1 in 1 files at da852e4",
          "hitl": "none found: patterns hitl-v0.1 in 1 files at da852e4"
        },
        "unknown": [
          "cred"
        ]
      },
      "min_config": {
        "status": "derived",
        "claude_code": "permissions.allow: [Read, Grep]; keep Bash on ask, and run decryptor scripts only in a disposable VM without network",
        "note": "derived from the code, not tested in the lab"
      },
      "override": null,
      "reviews": []
    },
    "status": {
      "tier": "listed",
      "last_checked": "2026-10-21",
      "next_check": "2027-01-19",
      "freshness": "fresh",
      "superseded": false,
      "superseded_by": null,
      "added": "2026-10-21",
      "added_by": "scout"
    },
    "evidence": {
      "runs": [],
      "badge": "/badge/tomabai-malware-analyst.svg"
    },
    "changes": []
  },
  "profile": {
    "schema_version": "0.1",
    "entry": "tomabai-malware-analyst",
    "draft": "review",
    "commit": "da852e499faad38a539d43b6000bd4bc8d0b11b9",
    "read_on": "2026-10-25",
    "check": {
      "date": "2026-10-25",
      "facts": 33,
      "confirmed": 33,
      "verified": 30
    },
    "overview": {
      "text": "A static malware analysis skill that deobfuscates and reverse-engineers suspicious files and writes detection signatures for them.",
      "ev": "SKILL.md#L3 frontmatter description of the skill"
    },
    "purpose": [
      {
        "text": "Deobfuscates suspicious files layer by layer, explains what the code does, extracts indicators of compromise and writes variant-agnostic detection signatures.",
        "ev": "README.md#L3 author's one-line description"
      },
      {
        "text": "Meant for files a user shares as suspicious, obfuscated scripts, and samples of named families such as Sandworm, Agent Tesla and malOpenclaw.",
        "ev": "SKILL.md#L3 trigger conditions in the frontmatter description"
      },
      {
        "text": "Produces indicators of compromise as concrete artifacts for detection and incident response.",
        "ev": "SKILL.md#L99 Phase 4 states what the IOCs are for"
      }
    ],
    "use_cases": [
      {
        "text": "Deobfuscate an obfuscated script or dropper layer by layer (base64, hex, XOR, eval/exec wrappers, custom ciphers) and show each layer.",
        "task": "malware-reversing",
        "ev": "README.md#L10 Phase 2 description"
      },
      {
        "text": "Extract network, filesystem, behavioural and cryptographic IOCs from a sample, each tagged with a confidence level.",
        "task": "dfir",
        "ev": "README.md#L12 Phase 4 description"
      },
      {
        "text": "Write text-based signatures for grep, YARA strings or SIEM rules.",
        "task": "detection-engineering",
        "ev": "SKILL.md#L139 heading of the text signature section in Phase 5"
      },
      {
        "text": "Triage a compiled binary by noting its format, extracting readable strings and imports, and flagging suspicious API calls.",
        "task": "malware-reversing",
        "ev": "SKILL.md#L206 edge case for binary or compiled files"
      }
    ],
    "not_for": [
      {
        "text": "The skill rules out executing the sample in any form, including in a sandbox or partially; analysis is static.",
        "ev": "SKILL.md#L12 the golden rule"
      }
    ],
    "capabilities": {
      "coverage": "complete",
      "count": {
        "n": 6,
        "unit": "steps",
        "by": "author",
        "text": "The author describes the workflow as six phases.",
        "ev": "README.md#L7 author states a 6-phase workflow"
      },
      "groups": [
        {
          "name": "Phase 1: Initial Triage",
          "does": "Identifies file type, target language or runtime, surface-level obfuscation technique and the likely number of layers.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "SKILL.md#L20-27 Phase 1 checklist"
        },
        {
          "name": "Phase 2: Full Deobfuscation",
          "does": "Writes a standalone decryptor file with the cipher algorithm and encrypted data taken from the sample, brute-forces array-rotation offsets and runs it with node or uv run python.",
          "effects": [
            "reads",
            "changes",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "SKILL.md#L64-68 steps for writing and running a static decryptor"
        },
        {
          "name": "Phase 3: Behavioral Analysis",
          "does": "Explains the sample's purpose and execution flow in plain English, step by step, and assesses which capabilities from a capability breakdown are present.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "SKILL.md#L74-82 Phase 3 structure"
        },
        {
          "name": "Phase 4: IOC Extraction",
          "does": "Resolves still-obfuscated values with a static decryptor before listing IOCs as concrete values; tags each IOC high, medium or low confidence and [decrypted] where applicable.",
          "effects": [
            "reads",
            "changes",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "SKILL.md#L123-127 IOC extraction standard and confidence tags"
        },
        {
          "name": "Phase 5: Detection Signatures",
          "does": "Writes text-based (grep/YARA/SIEM) and regex signatures meant to catch variants by targeting the technique rather than the sample's variable names or literals.",
          "effects": [],
          "enabled": "default",
          "ev": "README.md#L13 Phase 5 description"
        },
        {
          "name": "Phase 6: Threat Summary",
          "does": "Produces a concise, shareable report with category, sophistication, most-dangerous capability and immediate containment actions.",
          "effects": [],
          "enabled": "default",
          "ev": "README.md#L14 Phase 6 description"
        }
      ]
    },
    "architecture": {
      "summary": {
        "text": "Skill instructions that the client's model follows; when a layer appears to need runtime to decode, the model writes and runs a separate script implementing only the decryption algorithm against the extracted ciphertext.",
        "ev": "SKILL.md#L56 instruction to write and run a separate decryptor script"
      },
      "runs": {
        "where": "in-client",
        "text": "Runs as skill instructions inside Claude Code after the folder is placed in the user's skills directory.",
        "ev": "README.md#L22 usage section"
      },
      "modes": [
        {
          "where": "in-client",
          "mode": "slash command",
          "switch": "/malware-analyst",
          "text": "The repository's listing file malware-analyst.md gives /malware-analyst as the invocation.",
          "ev": "malware-analyst.md#L12 invocation field in the listing frontmatter"
        }
      ],
      "parts": [
        {
          "name": "SKILL.md instructions",
          "zone": "client",
          "does": "SKILL.md instructions that the model works through phase by phase, showing its work at each step.",
          "ev": "SKILL.md#L18 workflow instruction"
        },
        {
          "name": "Suspicious sample",
          "zone": "machine",
          "does": "The suspicious file or pasted obfuscated code the user shares, which the model reads.",
          "ev": "SKILL.md#L3 input the skill triggers on"
        },
        {
          "name": "Static decryptor script",
          "zone": "machine",
          "does": "Decryptor script that the model runs with node for JavaScript or uv run python for Python.",
          "ev": "SKILL.md#L68 how the decryptor is run"
        }
      ],
      "listens": [],
      "connections": [],
      "model": {
        "who": "client",
        "text": "The client's model performs the analysis by reasoning about what the code does from reading it, not running it.",
        "ev": "SKILL.md#L8 role statement"
      }
    },
    "needs": [
      {
        "kind": "runtime",
        "text": "Claude Code as the AI client.",
        "ev": "malware-analyst.md#L11 compatible platforms in the listing frontmatter"
      },
      {
        "kind": "tools",
        "text": "node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor.",
        "ev": "SKILL.md#L68 interpreters named for the decryptor"
      }
    ],
    "installer": [
      {
        "text": "Manual install: the user places the malware-analyst/ directory containing SKILL.md in the user-level ~/.claude/skills/ directory.",
        "ev": "README.md#L22 usage instructions"
      }
    ],
    "limits": [
      {
        "text": "When a layer needs runtime to decode, the skill has the model copy the cipher algorithm verbatim from the sample into a new file and run it; the author does not count this as executing the malware.",
        "ev": "SKILL.md#L56-65 decryptor guidance"
      },
      {
        "text": "The SKILL.md frontmatter has two fields, name and description.",
        "ev": "SKILL.md#L1-4 frontmatter"
      },
      {
        "text": "Values whose key is derived at runtime, such as from a machine UUID, are reported as unresolved with what is known about their structure.",
        "ev": "SKILL.md#L72 handling of runtime-only secrets"
      },
      {
        "text": "For binary or compiled files the author does not expect full deobfuscation; output is strings, imports, suspicious API calls and behavioural clues.",
        "ev": "SKILL.md#L206 binary edge case"
      },
      {
        "text": "For array-rotation obfuscation, the decryptor brute-forces the rotation offset by re-running the integrity check across all offsets until the checksum matches.",
        "ev": "SKILL.md#L67 step 3 of writing a static decryptor"
      },
      {
        "text": "A standing rule tells the model to write and run a standalone decryptor script whenever strings are encrypted with a key visible in the source, instead of reporting obfuscated placeholders as IOCs.",
        "ev": "SKILL.md#L218 standing rule on static decryptors"
      },
      {
        "text": "The skill description tells the client to trigger the skill when the user pastes heavily obfuscated code, even if the user does not say malware.",
        "ev": "SKILL.md#L3 trigger conditions in the frontmatter description"
      }
    ],
    "not_found": [
      {
        "field": "maturity",
        "searched": "README.md, SKILL.md, malware-analyst.md for preview, experimental, alpha, beta, stable, deprecated; malware-analyst.md#L7 has tier \"unreviewed\", which is not a maturity word"
      },
      {
        "field": "autonomy",
        "searched": "entry type is skill, not agent; SKILL.md has no autonomy or checkpoint statement"
      },
      {
        "field": "listen",
        "searched": "SKILL.md, README.md, malware-analyst.md for server, host, port, bind, listener; the repository has no code files"
      },
      {
        "field": "connection",
        "searched": "SKILL.md, README.md, malware-analyst.md for URLs, fetch, curl, API calls, downloads, telemetry; the only URLs are docs and GitHub links in README.md#L22 and malware-analyst.md#L4"
      },
      {
        "field": "need (credentials, account, model-key)",
        "searched": "SKILL.md, README.md, malware-analyst.md for tokens, API keys, accounts, environment variables"
      }
    ]
  },
  "verdict": null,
  "runs": []
}