Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-malware-sandbox-evasion-techniquesgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malware-sandbox-evasion-techniques)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malware-sandbox-evasion-techniques"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-malware-sandbox-evasion-techniques/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malware-sandbox-evasion-techniques"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-malware-sandbox-evasion-techniques.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.00552 |
| Opus 5 | $0.00030 | $0.00276 |
| Sonnet 5 | $0.00012 | $0.00110 |
| Haiku 4.5 | $0.00006 | $0.00055 |
Grade A, and why
analyzing-malware-sandbox-evasion-techniques scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
分析恶意软件沙箱逃避技术
概述
沙箱逃避（MITRE ATT&CK T1497）允许恶意软件检测分析环境并改变行为以规避检测。本技能分析 Cuckoo Sandbox 和 AnyRun 的行为报告中的逃避指标，包括基于时序的检查（GetTickCount、QueryPerformanceCounter、睡眠膨胀）、虚拟机工件检测（注册表键、MAC 地址前缀、进程名称如 vmtoolsd.exe）、用户交互检测（鼠标移动、键盘输入）和环境指纹识别（磁盘大小、CPU 数量、内存容量）。检测规则标记表现出这些行为的样本以供深入人工分析。
前置条件
- Cuckoo Sandbox 2.0+ 或 AnyRun 账户，用于行为分析报告
- Python 3.8+，带 json 库用于报告解析
- JSON 格式的行为报告导出
步骤
- 解析 Cuckoo/AnyRun 行为报告 JSON 文件
- 提取与时序相关函数的 API 调用序列
- 通过注册表查询和 WMI 调用识别虚拟机工件检测
- 通过比较请求的与实际的睡眠时长检测睡眠膨胀
- 标记用户交互检测（GetCursorPos、GetAsyncKeyState 模式）
- 根据技术数量和多样性对逃避复杂性进行评分
- 将检测到的技术映射到 MITRE ATT&CK T1497 子技术
预期输出
JSON 报告，列出检测到的逃避技术及 MITRE ATT&CK 映射、API 调用证据、逃避复杂性评分，以及逃避类别分类（时序、虚拟机检测、用户交互、环境指纹识别）。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 44 lines · 60 tokens per session scan A ba533d8b2a82
analyzing-malware-sandbox-evasion-techniques is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 60 tokens to every session and 552 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-malware-sandbox-evasion-techniques
Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for…
analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.