analyzing-macro-malware-in-office-documents
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific niche (malicious VBA macro analysis), lists concrete capabilities and tools, and provides explicit activation triggers. It uses proper third-person voice throughout and covers natural trigger terms comprehensively. This description would allow Claude to confidently select this skill when appropriate and avoid false matches.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques' and names specific tools like 'olevba, oledump, and VBA deobfuscation'. Very detailed and actionable. | 3 / 3 |
Completeness | Clearly answers both what ('Analyzes malicious VBA macros... to identify download cradles, payload execution...') and when ('Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination'). Explicit trigger guidance is present. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'VBA macros', 'Microsoft Office documents', 'Word, Excel, PowerPoint', 'Office macro analysis', 'VBA malware investigation', 'maldoc analysis', 'document-based threat examination'. These are terms a security analyst would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on malicious VBA macro analysis in Office documents. The combination of malware analysis, specific tools (olevba, oledump), and Office document focus makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured, highly actionable skill for Office macro malware analysis with executable commands and scripts throughout. Its main weaknesses are verbosity from including concept definitions Claude already knows (Key Concepts table, Tools descriptions) and a monolithic structure that could benefit from splitting reference material into separate files. The workflow is logically sequenced and the output format template is a strong addition.
Suggestions
Remove or significantly trim the 'Key Concepts' table — Claude already knows what VBA macros, OLE, DDE, and Protected View are.
Remove the 'Tools & Systems' section since each tool's purpose is already demonstrated in the workflow steps.
Consider extracting the deobfuscation Python script and the common VBA elements reference list into separate linked files to reduce the main skill's token footprint.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary content. The 'Key Concepts' table explains terms like VBA Macro, OLE, and DDE that Claude already knows. The 'Tools & Systems' section also restates what the tools do despite already demonstrating their usage. However, the workflow steps themselves are reasonably efficient. | 2 / 3 |
Actionability | The skill provides fully executable bash commands and Python scripts throughout. The olevba/oledump commands are copy-paste ready, the deobfuscation Python script is complete and functional, and the DDE/remote template detection scripts are concrete and executable. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced from triage through reporting, with each step building logically on the previous one. The scenario section includes explicit pitfalls to avoid, and the workflow naturally validates at each stage (triage confirms macros exist before extraction, deobfuscation follows extraction, non-macro vectors are checked separately). | 3 / 3 |
Progressive Disclosure | The content is entirely monolithic — everything is in a single file with no references to external files for advanced topics. The Key Concepts table, Tools & Systems section, and detailed scenario could be split into separate reference files. However, the internal structure with clear headers is reasonable for navigation. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.