analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with complete, executable examples and a clear step sequence, but it is padded by concept re-explanation and inlined code that duplicates bundle files, and it fails to point readers to the existing references/scripts/assets bundles. Tightening the overview and linking the bundles would improve conciseness and progressive disclosure.

Suggestions

Replace the large inline Step 1-4 code blocks with concise excerpts and point to scripts/process.py and scripts/agent.py for the full runnable tooling.

Add a navigation block linking references/api-reference.md, references/workflows.md, references/standards.md, and assets/template.md so the bundle files are discoverable.

Insert inline validation checkpoints between workflow steps (e.g. 'If no config found, try the alternate XOR key; only proceed to TLV parsing when the magic bytes match') to add feedback loops.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with executable code, but the Overview re-explains what Cobalt Strike is and the four large inline Python blocks (~200 lines) largely duplicate the scripts/ bundle files, so it includes unnecessary explanation and could be tightened; not a 2 because the material is actionable rather than purely padded.	3 / 5
Actionability	Four complete, copy-paste-ready Python examples (config extraction via dissect.cobaltstrike, manual XOR+TLV decryption, YARA detection, network/C2 analysis with signature generation) cover the common cases, matching the 'fully executable; copy-paste ready code; specific examples cover common cases' anchor.	5 / 5
Workflow Clarity	Steps 1-4 are clearly sequenced and a Validation Criteria list exists, but there are no inline validation checkpoints or feedback loops (validate -> fix -> retry) woven between steps, matching 'steps listed but validation gaps; checkpoints missing or implicit'; not a 4 because checkpoints are absent from the workflow itself rather than just minor gaps.	3 / 5
Progressive Disclosure	Section structure is clear (Overview, When to Use, Prerequisites, Key Concepts, Workflow, Validation Criteria, References), but the large inline code belongs in the existing scripts/ bundle and the references/, scripts/, and assets/ bundle files are never linked from the body, fitting 'some structure but could be better organized; content that should be separate is inline'; not a 2 because section headers keep it navigable.	3 / 5
	Total	14 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a clear, distinct niche with good natural trigger terms, but it omits any explicit 'Use when...' trigger guidance, which caps completeness at 3. Adding a usage-trigger clause would raise the completeness and trigger-term scores.

Suggestions

Append an explicit trigger clause, e.g. 'Use when analyzing Cobalt Strike beacon payloads from PE files, shellcode, or memory dumps during incident response or threat hunting.'

Add natural synonyms users say such as 'beacon config', 'config extraction', and 'threat hunting' to broaden trigger-term coverage.

Consider enumerating one or two more concrete outputs (e.g. watermark attribution, YARA/Suricata signature generation) to push specificity toward comprehensive.

Dimension	Reasoning	Score
Specificity	Quotes 'Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft' list several concrete actions (extract, analyze, identify) with concrete input sources (PE files, memory dumps), matching the 'several specific actions; minor gaps' anchor; not a 5 because the action set is compact rather than a comprehensive enumerated list.	4 / 5
Completeness	The 'what' is clear ('Extract and analyze... to identify C2 infrastructure, malleable profiles, and operator tradecraft') but there is no 'Use when...' clause or equivalent explicit trigger guidance, so per the rubric cap completeness stays at 3; not a 2 because the 'what' is explicit rather than vague.	3 / 5
Trigger Term Quality	Natural domain keywords a malware analyst would say are present ('Cobalt Strike beacon configuration', 'PE files', 'memory dumps', 'C2 infrastructure', 'malleable profiles'), giving good coverage; not a 5 because common synonyms/variants ('beacon config', 'threat hunting', 'config extraction') are absent.	4 / 5
Distinctiveness Conflict Risk	The Cobalt Strike beacon configuration niche with PE/memory-dump inputs is a clear, distinct domain with minimal overlap risk against other skills, matching the 'clear niche with distinct triggers; minimal conflict risk' anchor.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.