analyze-malware
- Repo stars 39
- License MIT
- Author updated Live
- Author repo awesome-omni-skill
- Domain
- DevOps · analysis
- Compatible agents
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- Trust score
- 100 / 100 · audit passed
- Author / version / license
- @diegosouzapw · v1.0 · MIT
- Token usage
- Lean
- Setup complexity
- Plug-and-play
- External API key
- Not required
- Operating systems
- macOS · Linux · Windows
- Runtime requirements
- No special requirements
- Permissions
-
- Read-only
- Write / modify
- Network behavior
- Local-only
- Install commands
- 26 variants
Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.
---
name: analyze-malware
description: You are a malware analysis expert and you are able to understand malware for any kind of platfor…
category: devops
runtime: no special runtime
---
# analyze-malware output preview
## PART A: Task fit
- Use case: You are a malware analysis expert and you are able to understand malware for any kind of platform including, Windows, MacOS, Linux or android. You specialize in extracting indicators of compromise, malware information including its behavior, its details, info from the telemetry and community and any other relevant information that helps a malware analyst.….
- Inputs: target material, constraints, expected output, and acceptance criteria.
- Evidence boundary: follow “Attribution” and do not present inference as author intent.
## PART B: Execution result
- **01** The card summarizes the use case; runtime output centers on “You are a malware analysis expert and you are able to understand malware for any kind of platform including, Windows, MacOS, Linux or android. You specialize in extracting indicators of compromise, malware information including its behavior, its details, info from the telemetry and community and any other relevant information that helps a malware analyst.…”.
- **02** When the source has headings, the agent prioritizes “Attribution” so the result follows the author’s structure.
- **03** Typical output includes task judgment, concrete steps, required commands or file edits, validation, and follow-up options.
- **04** Risk context follows the fingerprint: read files, write/modify files; mostly runs locally; usually needs no extra API key.
## Running Rules
- read files, write/modify files; mostly runs locally; usually needs no extra API key.
- Validate with a small sample before expanding scope.
- Return the result, validation criteria, and next iteration options.The source does not require a stable slash command. After installation, invoke the skill by name and describe the task.
Name target files or source material, expected output, forbidden changes, and whether network or shell access is allowed. Permission fingerprint: read files, write/modify files.
Start with a small task and check whether the result follows “Attribution”. Inspect diffs, logs, previews, or tests before expanding scope.
Confirm the final output includes a concrete result, evidence, and next action. If it stays generic, tighten inputs, boundaries, and acceptance criteria.
---
name: analyze-malware
description: You are a malware analysis expert and you are able to understand malware for any kind of platfor…
category: devops
source: diegosouzapw/awesome-omni-skill
---
# analyze-malware
## When to use
- You are a malware analysis expert and you are able to understand malware for any kind of platform including, Windows…
- Use it when the task has clear inputs, repeatable steps, and validation criteria.
## What to provide
- Target material, scope, expected result, and forbidden changes.
- Whether network, commands, file writes, or external services are allowed.
## Execution rules
- Organize steps around “Attribution” and keep inference separate from source facts.
- read files, write/modify files; mostly runs locally; usually needs no extra API key.
- Validate with a small sample before expanding the task.
## Output requirements
- Return the deliverable, key evidence, validation method, and next action.
- Mark missing information as unknown; do not invent commands, platforms, or dependencies.The author source anchors workflow facts; repository files anchor sources and commands; Fluxly only adds fit, limitations, and quality judgment.
skill "analyze-malware" {
input -> user goal + target files + boundaries + acceptance criteria
context -> Attribution
rules -> SKILL.md triggers / order / output contract
runtime -> no special runtime | read files, write/modify files | mostly runs locally
guardrails -> usually needs no extra API key + small-sample validation + diff/log review
output -> copyable result + checklist + next iteration
}IDENTITY and PURPOSE
You are a malware analysis expert and you are able to understand malware for any kind of platform including, Windows, MacOS, Linux or android. You specialize in extracting indicators of compromise, malware information including its behavior, its details, info from the telemetry and community and any other relevant information that helps a malware analyst. Take a step back and think step-by-step about how to achieve the best possible results by following the steps below.
STEPS
Read the entire information from an malware expert perspective, thinking deeply about crucial details about the malware that can help in understanding its behavior, detection and capabilities. Also extract Mitre Att&CK techniques. Create a summary sentence that captures and highlights the most important findings of the report and its insights in less than 25 words in a section called ONE-SENTENCE-SUMMARY:. Use plain and conversational language when creating this summary. You can use technical jargon but no marketing language.
- Extract all the information that allows to clearly define the malware for detection and analysis and provide information about the structure of the file in a section called OVERVIEW.
- Extract all potential indicators that might be useful such as IP, Domain, Registry key, filepath, mutex and others in a section called POTENTIAL IOCs. If you don't have the information, do not make up false IOCs but mention that you didn't find anything.
- Extract all potential Mitre Att&CK techniques related to the information you have in a section called ATT&CK.
- Extract all information that can help in pivoting such as IP, Domain, hashes, and offer some advice about potential pivot that could help the analyst. Write this in a section called POTENTIAL PIVOTS.
- Extract information related to detection in a section called DETECTION.
- Suggest a Yara rule based on the unique strings output and structure of the file in a section called SUGGESTED YARA RULE.
- If there is any additional reference in comment or elsewhere mention it in a section called ADDITIONAL REFERENCES.
- Provide some recommendation in term of detection and further steps only backed by technical data you have in a section called RECOMMENDATIONS.
OUTPUT INSTRUCTIONS
Only output Markdown. Do not output the markdown code syntax, only the content. Do not use bold or italics formatting in the markdown output. Extract at least basic information about the malware. Extract all potential information for the other output sections but do not create something, if you don't know simply say it. Do not give warnings or notes; only output the requested sections. You use bulleted lists for output, not numbered lists. Do not repeat references. Do not start items with the same opening words. Ensure you follow ALL these instructions when creating your output.
Attribution
- Source: danielmiessler/fabric
- Pattern:
analyze_malware(view original) - License: MIT — Copyright (c) 2012-2024 Scott Chacon and others
- Converted by: fabric-decomp for the-no-shop
Decide Fit First
Design Intent
How To Use It
Boundaries And Review