Tessl • The management layer for AI agent skills

SkillPublic

analyzing-malware-sandbox-evasion-techniques

Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for evasion indicators, or when building detections for anti-analysis techniques.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-structured overview that underuses its own bundle: the actionable executable script and API reference are present but unlinked from the body, and the workflow lacks validation checkpoints.

Suggestions

Reference the bundled tooling directly in the Steps section, e.g. 'Run `python scripts/agent.py --report <report.json> --output evasion_report.json`' and point detailed API/indicator tables to references/api-reference.md.

Add validation checkpoints to the workflow, such as confirming the parsed API-call count is non-zero and reviewing flagged findings before emitting the final report.

Inline one short code block showing the expected JSON report shape or a minimal parse snippet so the guidance is executable without leaving SKILL.md.

Dimension	Reasoning	Score
Conciseness	The body is lean (~30 lines) with well-organized sections; the Overview carries a small amount of explanatory context ('Sandbox evasion allows malware to detect analysis environments...') that could be trimmed but is mostly efficient.	4 / 5
Actionability	Steps name relevant APIs (GetTickCount, GetCursorPos, GetAsyncKeyState) but the body contains no executable code or commands and, critically, never references the bundled executable script (agent.py) that performs the work, leaving the reader without the specific steps to execute.	2 / 5
Workflow Clarity	Seven steps are listed in a clear sequence, but there are no validation checkpoints or feedback loops (e.g. verifying parsed API counts, confirming MITRE mappings), so the sequence is present but checkpoints are implicit.	3 / 5
Progressive Disclosure	The body is sectioned clearly, but the provided bundle files (scripts/agent.py and references/api-reference.md, including CLI usage) are never linked or signaled from the body, so references exist on disk but are not navigable from SKILL.md.	3 / 5
	Total	12 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description that concretely states capabilities, gives explicit trigger guidance, and occupies a distinct niche. Minor room only for additional keyword synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns', 'building detections for anti-analysis techniques') with comprehensive coverage of the domain.	5 / 5
Completeness	Explicitly answers both 'what' (detect evasion by analyzing timing/VM/user-interaction/sleep patterns from Cuckoo or AnyRun reports) and 'when' with a concrete 'Use when...' clause listing three trigger scenarios.	5 / 5
Trigger Term Quality	Strong natural terms ('sandbox', 'malware samples', 'Cuckoo', 'AnyRun', 'behavioral report', 'no or minimal activity in a sandbox') a user would say; a few synonyms/extensions (e.g. file extensions) are absent, so just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	A clear niche (sandbox/VM evasion in malware analysis from named sandbox tools) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md
Revision: 54a7988

Reviewed: 1 month ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

analyzing-malware-sandbox-evasion-techniques

Table of Contents

Is this your skill?