Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add gl0bal01/malware-analysis-claude-skills/plugin install malware-analysisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/detection-engineer)<a href="https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/detection-engineer"><img src="https://agentmods.dev/badge/skills/gl0bal01/malware-analysis-claude-skills/detection-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/detection-engineer"><img src="https://agentmods.dev/badge/skills/gl0bal01/malware-analysis-claude-skills/detection-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.06567 |
| Opus 5 | $0.00030 | $0.03284 |
| Sonnet 5 | $0.00012 | $0.01313 |
| Haiku 4.5 | $0.00006 | $0.00657 |
Grade B, and why
detection-engineer scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Exfiltrates the system prompt through a toolmediumSystem prompt leakage
Writing or sending the system prompt to a file, endpoint or log moves it out of the session.
- **Write rules to files:** `detections/sigma/<name>.yml`, `detections/suricata/<name>.rules`, `detections/hunting/<platform>.txt`, `detections/iocs.csv|.json`. Create the directories. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 818 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Detection Engineer
Transform malware analysis findings into production-ready detection rules, hunting queries, and operationalized IOCs.
Note: YARA rules are authored in the
malware-report-writerskill, not here. This skill covers Sigma rules, Suricata/Snort rules, and hunting queries.
Execution Model
- Start from the evidence, not from the user's memory. Read
analysis_state.md,procmon_summary.txt,sysmon_summary.txt, and the tshark exports yourself; every rule below is derived from a specific observed behavior or network artifact, and you cite it in the rule'sdescription/reference. - Locate skill files. Scripts and reference files ship in this skill's directory. Set
R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"once (when installed as a plugin$CLAUDE_PLUGIN_ROOTis set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with$R, e.g.python3 "$R"/scripts/ioc_extract.py. - Write rules to files:
detections/sigma/<name>.yml,detections/suricata/<name>.rules,detections/hunting/<platform>.txt,detections/iocs.csv|.json. Create the directories. - Test what you can, say what you couldn't. Run
sigma checkandsuricata -T(below) when installed; otherwise writestatus: experimentaland note "untested" in the state file. Never claim a rule is validated without output to show. - Defang with the bundled script:
python3 scripts/ioc_extract.py <evidence files>(repo root) produces the deduplicated, defanged list;--format csv|jsonfeeds the export formats;--refangrestores live values for rule bodies. - UUIDs:
python3 -c "import uuid; print(uuid.uuid4())"per Sigma rule. SIDs: 1000000+ and unique across the engagement. - Ask the user only for: target SIEM/EDR platforms, deployment constraints (noise tolerance, log sources actually collected), and sharing scope (TLP).
When to Use This Skill
Use this skill when you need to:
- Write Sigma rules for SIEM detection (Splunk, Elastic, QRadar)
- Create Suricata/Snort rules for network IDS/IPS
- Generate hunting queries for EDR platforms
- Defang IOCs for safe documentation and sharing
- Convert IOCs to standard formats (STIX, OpenIOC, CSV)
- Assess IOC confidence levels and volatility
- Create detection logic from behavioral analysis
- Write threat hunting hypotheses
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +19 lines scan A → B 0d3fb38097c2
- 10d ago First seen · 799 lines · 59 tokens per session scan A fc06be71641d
detection-engineer is a skill published in the GitHub repository gl0bal01/malware-analysis-claude-skills (46 stars, last pushed 4d ago), licensed MIT. It adds 59 tokens to every session and 6,567 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (exfiltrates the system prompt through a tool). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
Incident Response & Digital Forensics
IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology.
building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident…
building-soc-playbook-for-ransomware
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and…
collecting-volatile-evidence-from-compromised-host
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
building-ransomware-playbook-with-cisa-framework
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning…