analyzing-malware-persistence-with-autoruns

Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-malware-persistence-with-autoruns/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is action-oriented and mostly lean, with a real autorunsc invocation and parsing logic, but the workflow is an orphaned single step without integrated validation checkpoints and the skill completely fails to surface its own bundle files, inlining a script that already exists separately.

Suggestions

Wire the body to the bundle: reference references/api-reference.md for full CLI flags, references/workflows.md for the multi-step flow, scripts/agent.py instead of inlining the duplicated scanner, and assets/template.md for the report output.

Turn 'Step 1' into a real sequenced workflow (scan -> baseline-diff -> triage flagged entries -> validate coverage against Validation Criteria) with an explicit validation checkpoint before declaring persistence fully identified.

Fix the suspicious-path escape sequences (use raw strings r'\temp\' etc.) so the flagging branch actually matches paths, and add the LOLBin/path checks to mirror scripts/agent.py rather than diverging.

Dimension	Reasoning	Score
Conciseness	The Overview is dense domain-specific detail (18+ ASEP categories, -z offline flag) rather than padded basics, but the 'When to Use' bullets are templated and partly circular ('When investigating security incidents that require analyzing malware persistence with autoruns'), placing it at 'efficient; minor instances of over-explanation' rather than a clean 5.	4 / 5
Actionability	Provides a concrete, mostly copy-paste-ready script with the real autorunsc invocation and parsing/flagging logic, but the suspicious-path list uses broken escape sequences ('\temp\', '\appdata\local\temp') where \t and \a become control chars, so that detection branch silently misfires — a minor gap keeping it below fully-executable 5.	4 / 5
Workflow Clarity	The section is titled 'Step 1' with no Step 2/3, and the Validation Criteria sit as a separate list rather than an explicit validate-then-proceed checkpoint inside the workflow; per the batch-operation cap this is a batch scan without an integrated feedback loop, so it caps at 3.	3 / 5
Progressive Disclosure	Bundle files exist (references/api-reference.md, standards.md, workflows.md; scripts/agent.py; assets/template.md) but the body never links to any of them — the inline Python script duplicates scripts/agent.py and the 'References' section lists only external URLs, so local references are effectively buried and inlineable content is inlined, matching the 'minimal structure / references buried' anchor.	2 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states capabilities and concrete use-when triggers tied to incident response and persistence validation. Trigger term coverage is solid though not exhaustively synonym-rich, keeping it just short of perfect.

Dimension	Reasoning	Score
Specificity	Lists concrete actions ('enumerate and analyze') across an explicit, comprehensive set of persistence locations — 'registry run keys, scheduled tasks, services, drivers, and startup locations' — matching the 'multiple specific concrete actions; comprehensive coverage' anchor.	5 / 5
Completeness	Explicitly answers both what ('enumerate and analyze malware persistence mechanisms across ...') and when ('Use when hunting for persistence during Windows incident response, triaging ... or validating ...') with concrete trigger phrases, hitting the top anchor.	5 / 5
Trigger Term Quality	Natural phrases analysts say are present ('hunting for persistence', 'incident response', 'compromested endpoint', 'malware autostart entries'), but coverage stops short of the synonyms/file-extension breadth of a 5; 'Autoruns' itself is not surfaced as a user-spoken trigger in the when clause.	4 / 5
Distinctiveness Conflict Risk	A clear niche (Sysinternals Autoruns Windows persistence hunting) with distinct triggers and minimal overlap with other skills; matches the 'clear niche with distinct triggers; minimal conflict risk' anchor.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malware-persistence-with-autoruns/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.