一款适用于Claude、Codex和Gemini的恶意软件分析与逆向工程技能包。它为授权分析可疑Windows可执行文件、DLL、shellcode、打包样本、恶意文档、攻破指标、静态和动态分流、反分析处理、解包、检测工程以及简明的恶意软件报告提供了结构化的工作流程。

本项目仅用于防御性安全、教育、事件响应、取证和受控实验室研究。仅在获得授权时分析样本，使用隔离环境，除非明确许可且安全控制，否则避免使用活跃的恶意软件基础设施。

包含了什么

• claude/skills：兼容Claude的实用恶意软件分析技能文件。
• codex/skills：兼容Codex的技能文件、参考资料和特工元数据。
• gemini/skills：兼容双子座的技能文件和双子座专属的入口文档。
• references：方法论笔记，涵盖Windows反向、反分析、解包、行为分析、检测、IOCs及报告结构。

安装指南

克劳德

1. 打开你的Claude技能目录。

Malware Analysis Skill

A malware analysis and reverse-engineering skill package for Claude, Codex, and Gemini. It provides structured workflows for authorized analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, anti-analysis handling, unpacking, detection engineering, and concise malware reporting.

This project is intended for defensive security, education, incident response, forensics, and controlled lab research only. Analyze samples only when you have authorization, use isolated environments, and avoid live malware infrastructure unless explicitly permitted and safely controlled.

What Is Included

• claude/skills: Claude-compatible practical malware analysis skill files.
• codex/skills: Codex-compatible skill files, references, and agent metadata.
• gemini/skills: Gemini-compatible skill files and Gemini-specific entry document.
• references: Methodology notes covering Windows reversing, anti-analysis, unpacking, behavior analysis, detection, IOCs, and report structure.

Install Guide

Claude

1. Open your Claude skills directory.
2. Copy the contents of claude/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md and the references directory.
4. Restart or reload Claude if your environment requires it.
5. Ask Claude to use the Practical Malware Analysis skill for authorized malware triage or reverse-engineering tasks.

Codex

1. Open your Codex skills directory.
2. Copy the contents of codex/skills into a new skill folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, references, and any optional agents metadata.
4. Restart or reload Codex if needed.
5. Ask Codex to use the Practical Malware Analysis skill when working on defensive malware analysis, IOC extraction, detection logic, or malware report writing.

Gemini

1. Open your Gemini skills or custom instructions directory.
2. Copy the contents of gemini/skills into a new folder named malware-analysis.
3. Confirm the new folder contains SKILL.md, GEMINI.md, and the references directory.
4. Reload Gemini or reattach the skill documents according to your local setup.
5. Ask Gemini to follow the Practical Malware Analysis workflow for authorized lab analysis.

Recommended Lab Setup

• Use an isolated virtual machine with snapshots.
• Keep malware samples read-only until analysis requires controlled execution.
• Disable shared clipboard and shared folders unless they are strictly needed.
• Use host-only or simulated networking by default.
• Capture hashes, file metadata, strings, imports, network traffic, filesystem changes, registry changes, process activity, and persistence artifacts.
• Preserve notes that separate observed facts from analyst hypotheses.

Usage Examples

• “Use the Malware Analysis skill to triage this suspicious Windows executable.”