analyzing-macro-malware-in-office-documents
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Risky
Do not use without reviewing
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific niche (malicious VBA macro analysis), lists concrete capabilities and tools, and provides explicit activation triggers. It uses proper third-person voice throughout and covers natural trigger terms that security analysts would use. The description is comprehensive yet concise, making it easy for Claude to distinguish from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques' and names specific tools like 'olevba, oledump, and VBA deobfuscation'. Very detailed and actionable. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes malicious VBA macros, identifies download cradles, payload execution, persistence mechanisms, uses specific tools) and 'when' ('Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination'). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms users would say: 'Office macro analysis', 'VBA malware', 'maldoc analysis', 'document-based threat', 'Microsoft Office documents', 'Word, Excel, PowerPoint'. These are terms a security analyst would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on malicious VBA macro analysis in Office documents. The combination of malware analysis, specific tools (olevba, oledump), and security-specific terminology makes it very unlikely to conflict with general document processing or coding skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, actionable skill with a well-sequenced workflow covering the full macro malware analysis pipeline. Its main weaknesses are moderate verbosity from definitional content Claude doesn't need (Key Concepts, Tools & Systems descriptions) and a monolithic structure that could benefit from splitting reference material into separate files. The executable code examples and clear scenario walkthrough are excellent.
Suggestions
Remove or significantly trim the 'Key Concepts' table and 'Tools & Systems' section—Claude already knows what VBA macros, OLE, and DDE are, and the tools are demonstrated in the workflow itself.
Move the detailed output format template and common scenarios into separate reference files (e.g., OUTPUT_FORMAT.md, SCENARIOS.md) and link to them from the main skill.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary content. The 'Key Concepts' table explains terms like VBA Macro, OLE, and DDE that Claude already knows. The 'Tools & Systems' section also restates what the tools do despite already demonstrating their usage. However, the workflow steps themselves are reasonably efficient. | 2 / 3 |
Actionability | The skill provides fully executable bash commands and Python scripts throughout. The olevba commands, oledump.py invocations, the deobfuscation Python script, and the DDE/remote template detection scripts are all copy-paste ready with concrete examples and specific flags. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced from triage through extraction, deobfuscation, XLM analysis, non-macro vector checks, and reporting. Each step builds logically on the previous one. The scenario section includes a pitfalls list that serves as validation guidance, and the workflow inherently follows a safe analysis pattern (command-line tools in isolated VM, never opening in Office). | 3 / 3 |
Progressive Disclosure | The content is a monolithic document at ~250 lines with no references to external files for detailed content. The Key Concepts table, Tools & Systems section, and the lengthy output format template could be split into separate reference files. The structure within the file is good with clear headers, but everything is inline. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
888bbe4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.