analyzing-linux-elf-malware

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-linux-elf-malware/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with executable code throughout and a clear sequenced workflow, but it is padded with concept/tool explanations Claude already knows and fails to route to the provided reference and script bundle files. Validation checkpoints for risky dynamic analysis are implicit.

Suggestions

Remove or trim the Key Concepts and Tools & Systems sections to concepts not already known to Claude, and de-duplicate Step 1's bash and Python ELF analysis and the Step 2/Step 6 persistence grep overlap.

Add explicit validation checkpoints in the workflow (e.g. confirm UPX unpacking succeeded before strings analysis, confirm isolated VM/Docker environment before strace/ltrace execution) with a fix-and-retry loop.

Link the bundle files from the body (e.g. 'See [references/api-reference.md](references/api-reference.md) for full readelf/strace/GDB syntax' and 'Run [scripts/agent.py](scripts/agent.py) for automated static triage') and move the inlined tool-syntax detail into the reference file.

Dimension	Reasoning	Score
Conciseness	Code blocks are tight and actionable, but the Key Concepts and Tools & Systems sections re-explain concepts Claude already knows (ELF, strace, GOT/PLT, Ghidra), and Step 1 duplicates bash and Python ELF/header/hash analysis while Step 2 and Step 6 overlap on persistence grep patterns.	3 / 5
Actionability	Provides copy-paste-ready bash, Python (pyelftools), GDB, and strace/ltrace commands plus a concrete Ghidra procedure and a full report template, covering the common malware-analysis cases.	5 / 5
Workflow Clarity	The six steps are clearly numbered and sequenced, but a workflow that executes live malware lacks explicit validate→fix→retry checkpoints (e.g. confirm unpacking succeeded, confirm sandbox isolation before running), so the destructive-operation cap of 3 applies.	3 / 5
Progressive Disclosure	The body is well sectioned, but bundle files references/api-reference.md and scripts/agent.py are not signaled or linked from the body, and detailed tool syntax (readelf/strace/GDB) that already lives in api-reference.md is duplicated inline.	3 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that explicitly answers both what and when with concrete, natural trigger phrases and a clear domain niche. Minor room to improve specificity of granular actions and add a few more synonyms.

Dimension	Reasoning	Score
Specificity	Lists concrete analysis methods ('static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples') plus malware families and targets, but the actions are method-level categories rather than granular verbs like the score-5 anchor, leaving minor gaps.	4 / 5
Completeness	Clearly states what it does ('Analyze malicious Linux ELF binaries ... through static analysis, dynamic tracing, and reverse engineering') and explicitly when to use it with concrete trigger phrases via the 'Use when ...' clause.	5 / 5
Trigger Term Quality	Natural analyst phrases are present ('investigating Linux malware', 'triaging a suspicious ELF binary', 'assessing a compromised Linux server', 'analyzing container-targeted malware'), but a few synonyms (e.g. 'shared object', 'Linux executable') are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (malicious Linux ELF binaries) with distinct triggers and an explicit boundary ('Do not use for Windows PE binary analysis'), minimizing conflict with adjacent skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-linux-elf-malware/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.