Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add gl0bal01/malware-analysis-claude-skills/plugin install malware-analysisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/malware-triage)<a href="https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/malware-triage"><img src="https://agentmods.dev/badge/skills/gl0bal01/malware-analysis-claude-skills/malware-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gl0bal01/malware-analysis-claude-skills/malware-triage"><img src="https://agentmods.dev/badge/skills/gl0bal01/malware-analysis-claude-skills/malware-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.03595 |
| Opus 5 | $0.00037 | $0.01798 |
| Sonnet 5 | $0.00015 | $0.00719 |
| Haiku 4.5 | $0.00007 | $0.00360 |
Grade A, and why
malware-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Malware Triage
First phase for every sample. You run static tools on the host, interpret the output, classify the sample, and decide the next phase. Target: 5-15 minutes per sample.
Execution Model
- You run the commands. You have Bash. Execute every command in this skill yourself and interpret the output. Do not ask the user to run tools or paste results unless a tool is missing and cannot be installed.
- Locate skill files. Scripts and reference files ship in this skill's directory. Set
R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"once (when installed as a plugin$CLAUDE_PLUGIN_ROOTis set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with$R, e.g.python3 "$R"/scripts/ioc_extract.py. - Never execute the sample. Only static tools touch it:
file,strings,pe_info.py,upx -d,7z l, hashing. Nochmod +x, nowine, no./sample. - Never upload the sample to any service without explicit consent. Hash lookups are fine; file uploads are not.
- Script paths are relative to this skill directory. From the repo/skill root:
malware-triage/scripts/pe_info.py,malware-triage/scripts/hash_calculator.py,scripts/ioc_extract.py. Resolve them from wherever this SKILL.md lives. - Tool check first. Run once per session; note what is missing and degrade rather than stop:
command -v file strings upx 7z yara; python3 -c "import pefile" 2>&1 | tail -1 # pefile missing -> pip install pefile (needed by pe_info.py) - Big outputs: never
cata strings dump. Save to a file,wc -l, thengrep/head. - Ask the user only for: the sample path, context (where it came from, incident ID, anything already known), and reputation results if no MCP server is available.
Workflow
Step 1 — Identify and hash
S=/path/to/sample
file "$S"; ls -l "$S"
python3 malware-triage/scripts/hash_calculator.py "$S"
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · -287 lines · +23 tokens per session 0b17fefe2501
- 12d ago First seen · 516 lines · 51 tokens per session scan A f27cebdb69a7
malware-triage is a skill published in the GitHub repository gl0bal01/malware-analysis-claude-skills (46 stars, last pushed 6d ago), licensed MIT. It adds 74 tokens to every session and 3,595 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
Incident Response & Digital Forensics
IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology.
building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident…
building-soc-playbook-for-ransomware
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and…
collecting-volatile-evidence-from-compromised-host
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
building-ransomware-playbook-with-cisa-framework
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning…