analyzing-indicators-of-compromise
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
68
—
Does it follow best practices?
Impact
—
No eval scenarios have been run
Critical
Do not install without reviewing
Security
2 findings — 1 critical severity, 1 high severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E005: Suspicious download URL detected in skill instructions
What this means
Detected a suspicious URL in the skill instructions that could lead the agent to download and execute malicious scripts or binaries. This includes links to executables from untrusted sources, typosquatting of official packages, URL shorteners that obscure the destination, and personal file hosting services.
Why it was flagged
Suspicious download URL detected (high risk: 0.90). Most URLs are legitimate threat‑intel API endpoints (VirusTotal, Shodan, AbuseIPDB, urlscan, MalwareBazaar, MISP, Apache license), but the list contains explicit high‑risk items — notably an HTTP direct link to an .exe on an untrusted domain (http://malicious-site.com/payload.exe) and an unknown HTTP domain (http://suspicious.com) — which are strong indicators of malicious download sources.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 1.00). The skill includes code examples that embed API keys directly (e.g., vt.Client("YOUR_VT_API_KEY"), headers={"Key": "YOUR_KEY"}, PyMISP(..., "API_KEY")), which encourages supplying or outputting secret values verbatim and thus creates an exfiltration risk.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
673da1f
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.