malware analysis skills

duty1g/x64dbg-mcp-server

Skill Claude CodeCodex

You are controlling x64dbg through MCP tools.

ev-flow/quark-engine

Skill Claude CodeCodex

Validates dependabot dependency-update PRs against quark-engine's CI and drafts a merge/escalate recommendation. Use when asked to review, validate, or triage a dependabot PR on ev-flow/quark-engine, or when the user references issue 18z/QuarkHQ#3.

ev-flow/quark-engine

Skill Claude CodeCodex

Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.

ev-flow/quark-engine

Skill Claude CodeCodex

Frontend code quality checklist and review automation scripts for PRs touching UI, components, styles, and browser interactions.

miunasu/IDA-Skill

Skill Claude CodeCodex

A skill for reverse-engineering software with IDA Pro, a program for examining compiled applications. It uses IDAPython scripts to inspect disassembly, decompiled code, strings, imported functions, and references between code locations.

JameZUK/Arkana

Skill Claude CodeCodex

British English alias for the arkana-analyze skill. Binary analysis skill for Arkana. Triggers on: analyse, analyze, binary, malware, reverse engineer.

JameZUK/Arkana

Skill Claude CodeCodex

Binary analysis skill for Arkana. Handles malware triage, reverse engineering, PE/ELF/Mach-O analysis, shellcode emulation, firmware inspection, vulnerability auditing, C2 config extraction, unpacking, deobfuscation, and threat intelligence. Triggers on: binary, malware, PE, ELF, Mach-O, shellcode, firmware, analyze…

JameZUK/Arkana

Skill Claude CodeCodex

Interactive reverse engineering tutor using Arkana. Teaches binary analysis concepts from beginner to expert, adapting to the learner's level. Guides users through hands-on analysis or structured lessons using Arkana's 308 tools as the teaching platform. Triggers on: teach, learn, tutorial, lesson, explain, guide, how…

adriannoes/awesome-agentic-ai

Skill Claude CodeCodex

Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox…

adriannoes/awesome-agentic-ai

Skill Claude CodeCodex

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

26zl/cybersec-toolkit

Skill Claude CodeCodex

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.

DeepBitsTechnology/claude-plugins

Skill Claude CodeCodex

Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv, elf, so, macho, apk) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file…

DeepBitsTechnology/claude-plugins

Skill Claude CodeCodex

Query the Android/AOSP kernel CVE database to look up a specific CVE, find CVEs affecting a kernel version or build date, find unpatched CVEs in a branch, or identify exploitable vulnerabilities. Use this skill when the user asks about Android kernel CVEs, AOSP kernel vulnerabilities, which CVEs affect a kernel…

killvxk/cybersecurity-skills-zh

Skill Claude CodeCodex

A guide to extracting and examining Cobalt Strike Beacon settings from Windows executable files or memory dumps. Cobalt Strike is a security testing tool often misused by attackers, and Beacon is its remotely controlled payload.

meltedinhex/analyst-ai-pack

Skill Claude CodeCodex

Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.

meltedinhex/analyst-ai-pack

Skill Claude CodeCodex

Analyzes how a ransomware sample encrypts files: identifying the crypto scheme (symmetric/asymmetric/hybrid), key handling, file targeting and extension/marker changes, shadow-copy deletion, and ransom-note artifacts. Activates for requests to analyze ransomware encryption, assess decryptability, or study ransomware…

meltedinhex/analyst-ai-pack

Skill Claude CodeCodex

Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. Activates for requests to debug malware with x64dbg, set API breakpoints, or step through unpacking in…

dslsdzc/rev-skills

Skill Claude CodeCodex

A guide to symbolic execution with angr, a tool that explores program paths using unknown input values and a constraint solver. It is aimed at finding inputs that reach or avoid chosen points in a program.

dslsdzc/rev-skills

Skill Claude CodeCodex

Flutter/Dart AOT 逆向：libapp.so 快照分区解析、符号还原、Dart VM 动态分析。触发词：Flutter、Dart、libapp.so、AOT snapshot、kernelblob、flutterassets、Dart VM.

dslsdzc/rev-skills

Skill Claude CodeCodex

A guide to analysing game software made with Unity or Unreal, changing values in memory, examining Lua scripts, and inspecting graphics shaders. Cheat Engine is a Windows tool for scanning and modifying a running program's memory.

sector-b79/Malware-And-Reverse-Engineering-Skill-for-AI-Agents

Skill Claude CodeCodex

Defensive malware analysis and reverse-engineering workflow. Use for authorized lab analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, IDA/Ghidra/debugger reasoning, anti-analysis handling, unpacking, host/network…

Newmcpe/ida-reverse-engineering-skill

Skill Claude CodeCodex

Drive IDA Pro through the IDA Pro MCP like a senior reverse engineer: don't just narrate decompiler output, transform the database. Use this whenever the user is reverse engineering, analyzing malware, working a crackme or CTF, or doing binary/firmware analysis with IDA Pro over an MCP connection (mrexodia/ida-pro-mcp…

timwhitez/AutoRE-CLI

Skill Claude CodeCodex

Use Auto-RE CLI for bounded, machine-readable static reverse engineering of ELF, PE/COFF, Mach-O, universal Mach-O, object files, and explicitly identified raw shellcode. Use for binary or malware triage, decompilation, function/CFG/IL inspection, static call and data relationships, PE resources or strings, Go/Rust…