ctf-malware

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly concise and actionable as a quick-reference, but its workflow is a flat recipe list without validation checkpoints, and its progressive disclosure depends on bundle files that are missing from the package.

Suggestions

Add a brief ordered analysis workflow (triage -> static -> dynamic -> network) with validation/safety checkpoints before detonating samples.

Include the referenced bundle files (scripts-and-obfuscation.md, c2-and-protocols.md, pe-and-dotnet.md) or remove the dead references.

Flag sandbox-safety validation as an explicit checkpoint before dynamic analysis steps.

Dimension	Reasoning	Score
Conciseness	Lean one-liners per technique with executable commands and no padding of concepts Claude already knows; every line earns its place.	5 / 5
Actionability	Copy-paste ready bash/python commands cover common cases (tshark, peframe, volatility, yara), with specific signatures like '0x637c777b' S-box for AES identification.	5 / 5
Workflow Clarity	Techniques are listed as discrete recipes without an explicit end-to-end analysis workflow or validation checkpoints for destructive/batch operations like sample detonation; the destructive-skill cap applies.	3 / 5
Progressive Disclosure	The body repeatedly references scripts-and-obfuscation.md, c2-and-protocols.md, and pe-and-dotnet.md, but no such bundle files exist, so navigation points to nonexistent material.	2 / 5
	Total	15 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: specific, comprehensive, third-person, and explicit about both capabilities and trigger conditions. It distinguishes itself clearly within the CTF skill family.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions ('analyzing obfuscated scripts', 'extracting malware configurations', 'memory forensics for malware', 'process injection detection') with comprehensive coverage across malware and network analysis.	5 / 5
Completeness	Clearly answers what ('Provides malware analysis and network traffic techniques') and when ('Use when analyzing obfuscated scripts...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural terms including synonyms and file types ('obfuscated scripts', 'PE/.NET binaries', 'RC4/AES encrypted communications', 'YARA rules', 'C2 traffic').	5 / 5
Distinctiveness Conflict Risk	Clear niche (CTF malware/network analysis) with distinct triggers; minimal conflict risk given the specific malware-forensics framing.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 24 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-malware/SKILL.md
Commit: c332c7b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.