Malware Analysis Skill

A malware analysis and reverse-engineering skill package for Claude, Codex, and Gemini. It provides structured workflows for authorized analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, anti-analysis handling, unpacking, detection engineering, and concise malware reporting.

This project is intended for defensive security, education, incident response, forensics, and controlled lab research only. Analyze samples only when you have authorization, use isolated environments, and avoid live malware infrastructure unless explicitly permitted and safely controlled.

What Is Included

• claude/skills: Claude-compatible practical malware analysis skill files.
• codex/skills: Codex-compatible skill files, references, and agent metadata.
• gemini/skills: Gemini-compatible skill files and Gemini-specific entry document.
• references: Methodology notes covering Windows reversing, anti-analysis, unpacking, behavior analysis, detection, IOCs, and report structure.

Install Guide

Claude

1. Open your Claude skills directory.
2. Copy the contents of claude/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md and the references directory.
4. Restart or reload Claude if your environment requires it.
5. Ask Claude to use the Practical Malware Analysis skill for authorized malware triage or reverse-engineering tasks.

Codex

1. Open your Codex skills directory.
2. Copy the contents of codex/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, references, and any optional agents metadata.
4. Restart or reload Codex if needed.
5. Ask Codex to use the Practical Malware Analysis skill when working on defensive malware analysis, IOC extraction, detection logic, or malware report writing.

Gemini

1. Open your Gemini skills or custom instructions directory.
2. Copy the contents of gemini/skills into a new folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, GEMINI.md, and the references directory.
4. Reload Gemini or reattach the skill documents according to your local setup.
5. Ask Gemini to follow the Practical Malware Analysis workflow for authorized lab analysis.

Recommended Lab Setup

• Use an isolated virtual machine with snapshots.
• Keep malware samples read-only until analysis requires controlled execution.
• Disable shared clipboard and shared folders unless they are strictly needed.
• Use host-only or simulated networking by default.
• Capture hashes, file metadata, strings, imports, network traffic, filesystem changes, registry changes, process activity, and persistence artifacts.
• Preserve notes that separate observed facts from analyst hypotheses.

Usage Examples

• “Use the Malware Analysis skill to triage this suspicious Windows executable.”
• “Extract likely IOCs and detection ideas from these strings and imports.”
• “Help me plan a safe dynamic analysis run for an authorized sample.”
• “Create a concise malware report from my static and dynamic observations.”
• “Review this unpacking trace and suggest the next reverse-engineering steps.”

malware analysis, practical malware analysis, defensive malware analysis, reverse engineering, Windows malware analysis, malware triage, static malware analysis, dynamic malware analysis, packed malware, unpacking malware, anti-analysis, anti-debugging, anti-VM, indicators of compromise, IOC extraction, YARA rules, detection engineering, incident response, digital forensics, suspicious executable analysis, DLL analysis, shellcode analysis, malicious document analysis, Ghidra, IDA Pro, x86 reverse engineering, Windows API analysis, cybersecurity skill, AI malware analysis, Claude skill, Codex skill, Gemini skill