ctf-malware

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable quick-reference catalog with concrete commands and detection signatures, but it suffers from redundancy between the Additional Resources blurbs and the technique sections, lacks explicit validation checkpoints in its triage flow, and references three detail files that are not present in the bundle.

Suggestions

Provide the three referenced detail files (scripts-and-obfuscation.md, c2-and-protocols.md, pe-and-dotnet.md) so the progressive-disclosure links resolve; otherwise inline the critical details or remove the dangling links.

De-duplicate the 'Additional Resources' technique summaries against the body sections and merge the closing 'Network Indicators Quick Reference' with the Quick Start network block to tighten conciseness.

Add explicit validation checkpoints to the triage workflow (e.g., confirm a sample is actually malware-like before pivoting to /ctf-reverse, verify decrypted output is valid before trusting extracted C2 config) to lift workflow clarity.

Dimension	Reasoning	Score
Conciseness	Mostly lean one-liners and command blocks assuming competence, but the 'Additional Resources' descriptions restate technique lists already covered in the body sections and the closing 'Network Indicators Quick Reference' duplicates the Quick Start network block, so it could be tightened; not the fully lean (3) anchor nor the padded (1) anchor.	2 / 3
Actionability	Concrete executable commands throughout (tshark field extraction, peframe/pe-sieve/pestudio, vol3 windows.malfind, yara -r, pyinstxtractor) plus specific detection signatures ('0x637c777b S-box', 'expand 32-byte k', '0x9E3779B9'), matching the 'fully executable code/commands; copy-paste ready' anchor rather than the pseudocode (2) anchor.	3 / 3
Workflow Clarity	A reasonable triage sequence appears in 'Quick Start Commands' (static -> PE -> dynamic -> network -> YARA) plus 'When to Pivot' routing, but there are no explicit validation checkpoints or error-recovery feedback loops, so it sits at the 'sequence present but checkpoints missing' anchor rather than the validated (3) anchor.	2 / 3
Progressive Disclosure	The body is correctly structured as an overview with one-level-deep, well-signaled references to three detail files, but those referenced files (scripts-and-obfuscation.md, c2-and-protocols.md, pe-and-dotnet.md) do not exist in the bundle, breaking navigation; per the guideline to score against actual bundle structure, this caps it below the clean-navigation (3) anchor.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that covers a comprehensive set of concrete malware/network analysis actions with an explicit 'Use when ...' trigger clause and natural keyword coverage. It clearly defines both capability and invocation context with minimal fluff.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions — 'analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics ... anti-analysis techniques ... extracting malware configurations and indicators of compromise' — matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly states what it does ('Provides malware analysis and network traffic techniques for CTF challenges') and when to use it ('Use when analyzing ...'), matching the 'clearly answers both what AND when with explicit triggers' anchor; a missing Use-when clause would cap this at 2, but one is present.	3 / 3
Trigger Term Quality	Natural CTF/malware terms a user would say ('malware analysis', 'obfuscated scripts', 'C2 traffic', 'YARA rules', 'shellcode analysis', 'memory forensics') appear with good coverage of variations, fitting the 'good coverage of natural terms' anchor rather than the partial-coverage level below.	3 / 3
Distinctiveness Conflict Risk	Scoped to 'malware analysis and network traffic techniques for CTF challenges' with distinct triggers, a clear niche unlikely to fire for unrelated skills; not the generic 'helps with code and documents' (1) or the somewhat-overlapping (2) anchor.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 24 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-malware/SKILL.md
Commit: d19f35f

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.