Skills malware-analyst
📦

malware-analyst

Content revision r1 Safe ⚙️ External commands

Analyze Malware Safely

Malware investigations need repeatable triage without exposing production systems. This skill guides authorized analysts through safe analysis, IOC extraction, and reporting.

Supports: Claude Codex Code(CC)
🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "malware-analyst" from https://skillstore.io/skills/sickn33-malware-analyst.md and its manifest at https://skillstore.io/api/skills/sickn33-malware-analyst/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-malware-analyst.md Signed manifest GET /api/skills/sickn33-malware-analyst/manifest Signed lockfile GET /api/skills/sickn33-malware-analyst/lockfile

Test it

Using "malware-analyst". A user provides hashes, strings output, and sandbox notes for an authorized sample.

Expected outcome:

  • A concise triage summary with likely capabilities and confidence levels.
  • A prioritized IOC list covering network, file system, registry, and process artifacts.
  • Recommended next steps for containment, deeper analysis, and detection validation.

Using "malware-analyst". A responder asks how to structure malware findings for leadership and technical teams.

Expected outcome:

  • An executive summary in plain language.
  • A technical findings section with evidence and confidence notes.
  • Actionable recommendations for detection, mitigation, and follow-up collection.

Security Audit

Safe
v5 • 7/9/2026 Open versioned report

The static findings are false positives caused by Markdown fences, defensive malware terminology, and references to known analysis tools. I found no prompt injection attempt, credential exfiltration intent, or instruction to build malware. The skill is dual-use by domain, so author guidance should keep authorization and isolation requirements prominent.

1
Files scanned
248
Lines analyzed
0
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (22)
SKILL.md:27-37 SKILL.md:37-56 SKILL.md:56-73 SKILL.md:73-78 SKILL.md:78-87 SKILL.md:87-90 SKILL.md:90-98 SKILL.md:98-101 SKILL.md:101-109 SKILL.md:109-114 SKILL.md:114-120 SKILL.md:120-123 SKILL.md:123-129 SKILL.md:129-132 SKILL.md:132-138 SKILL.md:138-143 SKILL.md:143-165 SKILL.md:165-168 SKILL.md:168-183 SKILL.md:183-188 SKILL.md:188-222 SKILL.md:97
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-malware-analyst/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-malware-analyst/security.svg)](https://skillstore.io/skills/sickn33-malware-analyst?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-malware-analyst?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-malware-analyst/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-malware-analyst.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). malware-analyst security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-malware-analyst/audits/5

BibTeX citation

@techreport{sickn33-sickn33-malware-analyst-2026, author = {sickn33}, title = {malware-analyst security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-malware-analyst/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "malware-analyst security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-09" url: "https://skillstore.io/skills/sickn33-malware-analyst/audits/5" identifiers: - type: other value: "skillstore:sickn33-malware-analyst:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Triage Suspicious Files

Build a safe first-pass workflow for file identification, strings review, and initial risk assessment.

Summarize Sandbox Findings

Turn dynamic analysis observations into capabilities, IOCs, and collection gaps.

Prepare Threat Reports

Organize malware findings into clear reports for security teams and stakeholders.

Try These Prompts

Start File Triage 
Help me triage a suspicious Windows executable. I have the file type, SHA256 hash, and strings output. Build a safe checklist.
Review Sandbox Results 
Review these sandbox observations from an authorized malware sample. Identify likely capabilities, IOCs, and gaps in collection.
Correlate Static and Dynamic Findings 
Compare these static and dynamic findings. Propose a malware family hypothesis, confidence level, and additional evidence needed.
Draft Incident Briefing 
Prepare an incident response briefing from this malware analysis. Include summary, technical findings, IOCs, and containment recommendations.

Best Practices

  • Verify authorization and keep samples inside an isolated lab before any execution.
  • Record hashes, tooling versions, and collection times so findings are repeatable.
  • Separate confirmed IOCs from hypotheses and state confidence clearly.

Avoid

  • Running unknown samples on personal, production, or shared systems.
  • Treating a single indicator as attribution without corroborating evidence.
  • Publishing IOCs without context, timestamps, or confidence levels.

Frequently Asked Questions

Can this skill execute malware?
No. It provides analysis guidance. Any sample execution must happen in a controlled lab outside the assistant.
Is this skill for offensive malware development?
No. It is intended for defensive analysis, incident response, threat intelligence, and authorized research.
What inputs improve results?
Hashes, file type, strings, sandbox logs, network observations, and clear goals improve the analysis.
Can it write YARA rules?
It can suggest detection logic and rule structure from provided indicators, but rules need local testing.
Does it identify malware families?
It can propose hypotheses from evidence, but strong attribution requires corroboration from multiple sources.
Does it require paid tools?
No. The guidance mentions common commercial and open-source tools, and users can adapt the workflow.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/malware-analyst

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

9 downloads · 114 views

File structure

📄 SKILL.md

More from sickn33

View all

Related Skills

View all