Malware Analysis Skill

A malware analysis and reverse-engineering skill package for Claude, Codex, and Gemini. It provides structured workflows for authorized analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, anti-analysis handling, unpacking, detection engineering, and concise malware reporting.

This project is intended for defensive security, education, incident response, forensics, and controlled lab research only. Analyze samples only when you have authorization, use isolated environments, and avoid live malware infrastructure unless explicitly permitted and safely controlled.

What Is Included

• claude/skills: Claude-compatible practical malware analysis skill files.
• codex/skills: Codex-compatible skill files, references, and agent metadata.
• gemini/skills: Gemini-compatible skill files and Gemini-specific entry document.
• references: Methodology notes covering Windows reversing, anti-analysis, unpacking, behavior analysis, detection, IOCs, and report structure.

Install Guide

Claude

1. Open your Claude skills directory.
2. Copy the contents of claude/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md and the references directory.
4. Restart or reload Claude if your environment requires it.
5. Ask Claude to use the Practical Malware Analysis skill for authorized malware triage or reverse-engineering tasks.

Codex

1. Open your Codex skills directory.
2. Copy the contents of codex/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, references, and any optional agents metadata.
4. Restart or reload Codex if needed.
5. Ask Codex to use the Practical Malware Analysis skill when working on defensive malware analysis, IOC extraction, detection logic, or malware report writing.

Gemini

1. Open your Gemini skills or custom instructions directory.
2. Copy the contents of gemini/skills into a new folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, GEMINI.md, and the references directory.
4. Reload Gemini or reattach the skill documents according to your local setup.
5. Ask Gemini to follow the Practical Malware Analysis workflow for authorized lab analysis.

Recommended Lab Setup

• Use an isolated virtual machine with snapshots.
• Keep malware samples read-only until analysis requires controlled execution.
• Disable shared clipboard and shared folders unless they are strictly needed.
• Use host-only or simulated networking by default.
• Capture hashes, file metadata, strings, imports, network traffic, filesystem changes, registry changes, process activity, and persistence artifacts.
• Preserve notes that separate observed facts from analyst hypotheses.

Usage Examples

• “Use the Malware Analysis skill to triage this suspicious Windows executable.”