Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/deepbitstechnology/claude-plugins/binary-analysisnpx skills add DeepBitsTechnology/claude-plugins --skill binary-analysisgit clone --depth 1 https://github.com/DeepBitsTechnology/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00132 | $0.01710 |
| Opus 5 | $0.00066 | $0.00855 |
| Sonnet 5 | $0.00026 | $0.00342 |
| Haiku 4.5 | $0.00013 | $0.00171 |
Grade A, and why
binary-analysis scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
The upload is done with a short-lived `curl` command that you (Claude) run from your own shell via the Bash tool — the file's bytes stream directly to the server and never pass through the model context. How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Binary Analysis
This skill performs deep analysis of suspicious binaries using the remote Dr. Binary MCP server. The server runs analysis remotely and has no access to your local filesystem, so a local file must first be uploaded into the remote workspace before any analysis tool can read it.
The upload is done with a short-lived curl command that you (Claude) run from your own shell via the Bash tool — the file's bytes stream directly to the server and never pass through the model context.
When to Use This Skill
Use this skill when you need to:
- Analyze suspicious executable files (.exe, .dll, .sys, ELF, Mach-O, APK)
- Decompile binaries to understand their behavior
- Extract strings, imports, and exports from files
- Identify malware capabilities and techniques
- Perform static analysis on unknown binaries
- Investigate potential trojans, ransomware, or other malware
- Generate threat assessment reports
Workflow
Step 1: Upload the local file
Call prepare_upload with the name to store the file under. It returns a ready-to-run curl command containing a single-use upload link (valid for 10 minutes), with an <ABSOLUTE_LOCAL_PATH> placeholder.
prepare_upload(file_name="suspicious.exe")
Run the returned command yourself with the Bash tool, substituting <ABSOLUTE_LOCAL_PATH> with the absolute path to the local file. Do not print the command for the user to run — execute it directly. For example:
curl -f -F 'file=@/Users/me/Downloads/suspicious.exe' 'https://chat.deepbits.com/api/workspace/upload?upload_token=...'
On success the file is stored in the remote workspace under the chosen filename. The sandbox/analysis CWD is the workspace root, so you can refer to the file by its bare filename (e.g. suspicious.exe) in subsequent tool calls.
If the upload fails (expired or already-used token), call prepare_upload again to mint a fresh link.
Step 2: Triage with inspect_binary
Call inspect_binary with the stored filename for fast, lightweight triage (powered by rz-bin / Rizin). It returns bounded file info, entrypoints, sections, imports, exports, linked libraries, symbol-derived functions, and strings — without full decompilation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 170 lines · 132 tokens per session scan A 8154035d2a08
binary-analysis is a skill published in the GitHub repository DeepBitsTechnology/claude-plugins (46 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 132 tokens to every session and 1,710 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware…
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF…
analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.