analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-structured overview that delegates executable detail to a reference and script, but the body fails to link to those bundle files and lacks validation checkpoints in its workflow. Actionability and navigation are the main weaknesses.

Suggestions

Link the bundle files from the body, e.g. under Workflow or a References section: 'Full command reference: see references/api-reference.md' and 'Automated analysis: run scripts/agent.py <file>'.

Add executable commands inline for at least the triage step (e.g. `pdfid.py malicious.pdf`, `peepdf -i malicious.pdf`) so the body is copy-paste ready, not just descriptive.

Insert a validation checkpoint in the workflow, e.g. after extracting streams confirm the decoded output is non-empty and re-run js_analyse if a /JS object yields no content.

Dimension	Reasoning	Score
Conciseness	The body is lean — concise tables, terse workflow steps, and a compact output template — with no concept-explaining prose or evaluative padding; it assumes Claude's competence and earns its tokens, matching the 'lean and efficient' anchor.	3 / 3
Actionability	Steps are concrete in intent ('Triage with pdfid', 'Open PDF in peepdf interactive mode') but the body contains no actual executable commands or copy-paste code — those live only in the reference and script — so key details are missing per the score-2 anchor.	2 / 3
Workflow Clarity	The seven workflow steps are clearly sequenced, but there are no explicit validation checkpoints or feedback loops (e.g., re-scan after extraction, confirm stream decoded), which the score-3 anchor requires even though the operation is read-only.	2 / 3
Progressive Disclosure	Sections are well organized, but the body never signals the available bundle files — references/api-reference.md (full command reference) and scripts/agent.py (automated agent) — so the one-level-deep navigation the score-3 anchor expects is absent.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete actions and tools, supplies explicit 'Use when' triggers with natural phrasing, and occupies a clear niche. It cleanly satisfies all four dimensions.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('extract embedded JavaScript, shellcode, and suspicious objects') and names the exact tools (peepdf, pdfid, pdf-parser), matching the 'multiple specific concrete actions' anchor rather than the partial score-2 example.	3 / 3
Completeness	Explicitly answers both 'what' (static analysis to extract embedded JS/shellcode/suspicious objects) and 'when' via a clear 'Use when...' clause with concrete triggers, satisfying the top anchor.	3 / 3
Trigger Term Quality	Natural trigger phrases a user would say — 'suspicious PDF attachment from a phishing email', 'PDF-based exploit document', 'detection signatures for weaponized PDF threats' — give good coverage; it is not jargon-only nor missing common variations.	3 / 3
Distinctiveness Conflict Risk	The malicious-PDF / malware-analysis niche with tool-specific triggers is clearly distinguishable and unlikely to fire for unrelated skills; it is far more specific than the overlapping score-2 example.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malicious-pdf-with-peepdf/SKILL.md
Commit: e612f49

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.