analyst-ai-pack

In the author's own words, from each skill's SKILL.md — showing the first 30 of 119 files.

• analyzing-android-dex-malware

  Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.

  skills/analyzing-android-dex-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-api-call-traces

  Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.

  skills/analyzing-api-call-traces/SKILL.md on GitHub (opens in a new tab)

• analyzing-authenticode-signatures

  Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.

  skills/analyzing-authenticode-signatures/SKILL.md on GitHub (opens in a new tab)

• analyzing-banking-trojan-webinjects

  Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.

  skills/analyzing-banking-trojan-webinjects/SKILL.md on GitHub (opens in a new tab)

• analyzing-compiled-python-malware

  Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.

  skills/analyzing-compiled-python-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-cryptominer-malware

  Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.

  skills/analyzing-cryptominer-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-dotnet-malware-internals

  Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.

  skills/analyzing-dotnet-malware-internals/SKILL.md on GitHub (opens in a new tab)

• analyzing-elf-binaries-on-linux

  Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols and imports, segment permissions, embedded strings, and packing indicators to infer capability without execution. Activates for requests to analyze an ELF binary, Linux malware, or shared object.

  skills/analyzing-elf-binaries-on-linux/SKILL.md on GitHub (opens in a new tab)

• analyzing-excel-4-macro-malware

  Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.

  skills/analyzing-excel-4-macro-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-golang-malware-internals

  Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.

  skills/analyzing-golang-malware-internals/SKILL.md on GitHub (opens in a new tab)

• analyzing-infostealer-credential-theft

  Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.

  skills/analyzing-infostealer-credential-theft/SKILL.md on GitHub (opens in a new tab)

• analyzing-java-jar-malware

  Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates for requests to analyze a malicious JAR, inspect Java malware, or identify a Java RAT.

  skills/analyzing-java-jar-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-loaders-and-droppers

  Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.

  skills/analyzing-loaders-and-droppers/SKILL.md on GitHub (opens in a new tab)

• analyzing-mach-o-binaries-on-macos

  Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.

  skills/analyzing-mach-o-binaries-on-macos/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-iso-and-container-files

  Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.

  skills/analyzing-malicious-iso-and-container-files/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-lnk-files

  Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.

  skills/analyzing-malicious-lnk-files/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-office-macros

  Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.

  skills/analyzing-malicious-office-macros/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-onenote-and-html-smuggling

  Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with embedded payloads behind fake buttons, and HTML smuggling pages that reconstruct payloads in the browser from embedded blobs. Activates for requests to analyze a malicious OneNote file, detect HTML smuggling, or extract a smuggled/embedded payload.

  skills/analyzing-malicious-onenote-and-html-smuggling/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-pdfs

  Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. Activates for requests to analyze a malicious PDF, inspect PDF JavaScript, or extract embedded payloads from a PDF.

  skills/analyzing-malicious-pdfs/SKILL.md on GitHub (opens in a new tab)

• analyzing-malicious-vbscript-and-wsf

  Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.

  skills/analyzing-malicious-vbscript-and-wsf/SKILL.md on GitHub (opens in a new tab)

• analyzing-malware-in-memory-with-volatility3

  Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.

  skills/analyzing-malware-in-memory-with-volatility3/SKILL.md on GitHub (opens in a new tab)

• analyzing-pe-imports-and-exports

  Analyzes a PE file's import and export tables to infer capability: mapping imported APIs to behaviors (networking, crypto, injection, persistence), spotting dynamic-resolution stubs, and reading exports of malicious DLLs. Activates for requests to analyze PE imports, inspect the IAT/exports, or infer capability from API usage.

  skills/analyzing-pe-imports-and-exports/SKILL.md on GitHub (opens in a new tab)

• analyzing-position-independent-code

  Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk techniques, API-hash resolution loops, and relocation-free addressing so the payload can be disassembled at the right base. Activates for requests to analyze position-independent code, identify PIC techniques, or understand how shellcode resolves APIs without imports.

  skills/analyzing-position-independent-code/SKILL.md on GitHub (opens in a new tab)

• analyzing-ransomware-encryption-behavior

  Analyzes how a ransomware sample encrypts files: identifying the crypto scheme (symmetric/asymmetric/hybrid), key handling, file targeting and extension/marker changes, shadow-copy deletion, and ransom-note artifacts. Activates for requests to analyze ransomware encryption, assess decryptability, or study ransomware behavior.

  skills/analyzing-ransomware-encryption-behavior/SKILL.md on GitHub (opens in a new tab)

• analyzing-rat-command-and-control

  Analyzes remote access trojan command-and-control by mapping the RAT command set, identifying the C2 transport and beacon parameters, and cataloging operator capabilities from static strings and config. Activates for requests to analyze RAT C2, map a trojan command handler, or identify remote-access capabilities and C2 transport.

  skills/analyzing-rat-command-and-control/SKILL.md on GitHub (opens in a new tab)

• analyzing-rich-header-and-compiler-artifacts

  Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain.

  skills/analyzing-rich-header-and-compiler-artifacts/SKILL.md on GitHub (opens in a new tab)

• analyzing-rust-malware-internals

  Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates.

  skills/analyzing-rust-malware-internals/SKILL.md on GitHub (opens in a new tab)

• analyzing-webshells

  Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.

  skills/analyzing-webshells/SKILL.md on GitHub (opens in a new tab)

• analyzing-windows-driver-malware

  Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.

  skills/analyzing-windows-driver-malware/SKILL.md on GitHub (opens in a new tab)

• analyzing-wiper-malware

  Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify destructive disk-overwrite behavior, or tell a wiper apart from ransomware.

  skills/analyzing-wiper-malware/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• skillsby anthropics Public repository for Agent Skills 181k stars · 19 skills
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• agent-skillsby addyosmani Production-grade engineering skills for AI coding agents. 107k stars · 25 skills
• paperclipby paperclipai The open-source app everyone uses to manage agents at work 103k stars · 30 skills
• open-designby nexu-io The 1st Collaborative AI Design Agent Workspace. Local-first and open source. Create prototypes, websites, apps, dashboards, presentations,… 101k stars · 30 skills