AnalystAIPack

An open agent-skills library for malware analysis, reverse engineering, and threat hunting.

AnalystAIPack gives an AI agent the working knowledge of a malware analyst and threat hunter: which Volatility 3 plugin to run on a memory image, how to unpack a packed sample, how to hunt C2 beaconing in network logs, and how to turn findings into YARA and Sigma. It is a focused, depth-first library — 118 curated skills across four tightly-scoped subdomains, where every skill ships a tested, runnable analysis script, not just prose.

The name says what it is: a pack of ready-to-load AI agent skills for the security analyst — covering the full workflow to hunt, reverse, and analyze malicious code.

Independent project. Not affiliated with Anthropic, MITRE, or any vendor named here. Built from scratch and synthesized from many primary sources; not copied from any other skills repository. See CONTRIBUTING.md for the sourcing and originality policy.

Personal work. A personal, independent project maintained in a personal capacity. It is not affiliated with, endorsed by, or representative of the maintainer’s employer.

What makes it different

• Depth over breadth. Four deliberate subdomains (malware analysis, reverse engineering, threat hunting, and shared lab foundations) instead of a sprawling catalog — every skill is curated for the analyst’s real workflow.
• Every skill is runnable. All 118 skills ship a tested scripts/analyst.py (standard library only, optional deps degrade gracefully) plus a repo-addwide smoke-test harness and CI --check gates — so the tooling actually works, not just reads well.
• Safe by construction. Scripts perform static, read-only analysis and never execute the sample; IOCs are defanged in output; sample-handling skills carry an explicit Safety & Handling section.
• A defender’s framework lens. Skills map to MITRE ATT&CK, MITRE D3FEND, and MITRE CAR — chosen because they fit RE / malware analysis / threat hunting far better than compliance checklists.
• Consistent, opinionated shape. Each skill follows the same body contract — When to Use (with an explicit Do not use), Workflow, Validation, and Pitfalls — so an agent always knows the boundaries.

Scope

Three pillars plus a shared foundation: