一个开放的代理技能库，用于恶意软件分析、逆向工程和威胁狩猎。

分析师AIPack为AI代理提供了恶意软件分析师和威胁猎人的工作知识： 在内存映像上运行哪个Volatility 3插件，如何解压打包的采样，如何 在网络日志中寻找C2信标，以及如何将发现转化为YARA和Sigma。这是一个 聚焦、深度优先库——涵盖四个严格子领域、共118项精选技能， 每一项技能都附带经过测试、可运行的分析脚本，而不仅仅是散文。

名字说明了它的本质：一包即装的人工智能代理技能，用于安全 分析师——涵盖猎捕**、逆转和分析恶意的完整工作流程 代码。

独立项目。 与Anthropic、MITRE或此处提及的任何供应商无任何关联。 从零开始构建，综合了许多原始资料;未抄袭其他资料 技能库。请参见 CONTRIBUTING.md 关于来源和原创性政策。

个人作品。 一个以个人身份维护的个人独立项目。它是 不隶属于维护者的雇主，也未被其认可或代表。

AnalystAIPack

An open agent-skills library for malware analysis, reverse engineering, and threat hunting.

AnalystAIPack gives an AI agent the working knowledge of a malware analyst and threat hunter: which Volatility 3 plugin to run on a memory image, how to unpack a packed sample, how to hunt C2 beaconing in network logs, and how to turn findings into YARA and Sigma. It is a focused, depth-first library — 118 curated skills across four tightly-scoped subdomains, where every skill ships a tested, runnable analysis script, not just prose.

The name says what it is: a pack of ready-to-load AI agent skills for the security analyst — covering the full workflow to hunt, reverse, and analyze malicious code.

Independent project. Not affiliated with Anthropic, MITRE, or any vendor named here. Built from scratch and synthesized from many primary sources; not copied from any other skills repository. See CONTRIBUTING.md for the sourcing and originality policy.

Personal work. A personal, independent project maintained in a personal capacity. It is not affiliated with, endorsed by, or representative of the maintainer’s employer.

What makes it different

• Depth over breadth. Four deliberate subdomains (malware analysis, reverse engineering, threat hunting, and shared lab foundations) instead of a sprawling catalog — every skill is curated for the analyst’s real workflow.
• Every skill is runnable. All 118 skills ship a tested scripts/analyst.py (standard library only, optional deps degrade gracefully) plus a repo-addwide smoke-test harness and CI --check gates — so the tooling actually works, not just reads well.
• Safe by construction. Scripts perform static, read-only analysis and never execute the sample; IOCs are defanged in output; sample-handling skills carry an explicit Safety & Handling section.
• A defender’s framework lens. Skills map to MITRE ATT&CK, MITRE D3FEND, and MITRE CAR — chosen because they fit RE / malware analysis / threat hunting far better than compliance checklists.
• Consistent, opinionated shape. Each skill follows the same body contract — When to Use (with an explicit Do not use), Workflow, Validation, and Pitfalls — so an agent always knows the boundaries.

Scope

Three pillars plus a shared foundation: