analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-organized and concise, but the body is more descriptive than executable and fails to point to the accompanying api-reference.md and agent.py bundle files that contain the actual commands. Adding inline command examples and explicit reference links would lift actionability and progressive disclosure.

Suggestions

Add inline executable commands to key workflow steps (e.g. pdfid/pdf-parser/peepdf invocations) or link to references/api-reference.md at each step that needs them.

Add a short navigation line pointing to references/api-reference.md for the full command reference and scripts/agent.py for automated analysis.

Add an explicit validation/verification checkpoint (e.g. confirm stream decoded correctly before deobfuscation) to strengthen the workflow feedback loop.

Dimension	Reasoning	Score
Conciseness	Lean, well-sectioned content with compact tables and no padding explaining basic PDF concepts; the Tools & Systems table partially restates information already conveyed in Prerequisites and Workflow.	4 / 5
Actionability	Workflow steps name tools and outcomes but most lack executable commands inline (e.g. 'Dump suspicious streams and decode filters' gives no command); concrete commands live in references/api-reference.md rather than the body.	3 / 5
Workflow Clarity	A clear, logical 7-step sequence (triage -> interactive -> identify -> extract -> deobfuscate -> VT -> IOCs); no explicit validation checkpoints, but read-only static analysis does not require destructive-operation caps.	4 / 5
Progressive Disclosure	The body is sectioned but never signals or links the bundle files (references/api-reference.md, scripts/agent.py) that hold the executable commands and detail the workflow relies on, so references are present but not clearly navigated.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality description that clearly states capabilities, names the tools, and provides explicit natural-language triggers covering the main use cases. Only minor gap is missing .pdf extension and a few synonyms.

Dimension	Reasoning	Score
Specificity	Names the domain and concrete actions: 'extract embedded JavaScript, shellcode, and suspicious objects' using named tools (peepdf, pdfid, pdf-parser), giving comprehensive coverage of specific capabilities.	5 / 5
Completeness	Explicitly answers both what ('Perform static analysis of malicious PDF documents...to extract embedded JavaScript, shellcode, and suspicious objects') and when ('Use when triaging...analyzing...or building detection signatures').	5 / 5
Trigger Term Quality	Strong natural triggers ('suspicious PDF attachment from a phishing email', 'PDF-based exploit document', 'weaponized PDF threats', 'detection signatures') but lacks synonyms and the .pdf file extension.	4 / 5
Distinctiveness Conflict Risk	A clear niche (malicious PDF static analysis with peepdf/pdfid/pdf-parser) with distinct, specific triggers that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malicious-pdf-with-peepdf/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.