analyzing-malware-sandbox-evasion-techniques

Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for evasion indicators, or when building detections for anti-analysis techniques.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-organized and reasonably concise with a clear step sequence, but it lacks executable guidance and fails to point to its own bundled script and API reference, leaving the workflow without validation checkpoints.

Suggestions

Add an executable Quick-start example showing how to run scripts/agent.py on a report, and link to references/api-reference.md for the full indicator tables.

Insert a validation/verification checkpoint in the workflow (e.g., confirm evasion_findings are non-empty and spot-check API-call evidence before scoring sophistication).

Trim the Overview's explanatory sentence about what sandbox evasion is, keeping only the indicator taxonomy that adds value beyond Claude's existing knowledge.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean with terse sectioned steps, but the Overview paragraph explains the sandbox-evasion concept ('allows malware to detect analysis environments and alter behavior') that Claude already knows, which is mild padding.	2 / 3
Actionability	Steps name concrete APIs and indicators (GetTickCount, vmtoolsd.exe, GetCursorPos) but provide no executable code or commands in the body, and crucially never reference the bundled agent.py script that does the actual work — guidance is descriptive rather than copy-paste ready.	2 / 3
Workflow Clarity	Seven steps are clearly sequenced, but there are no validation/verification checkpoints or feedback loops for this batch report-analysis workflow, capping the score per the rubric guidance.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) but the body never signals or links to them; the Overview also inlines API indicators that overlap the separate reference file, so structure is present but references are not clearly surfaced.	2 / 3
	Total	8 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and well-structured, explicitly answering both what the skill does and when to invoke it with natural trigger terms and a distinct niche.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports' — matching the top anchor for specific concrete actions.	3 / 3
Completeness	Clearly answers both 'what' (detect/analyze evasion techniques) and 'when' via an explicit 'Use when...' clause with three concrete trigger scenarios.	3 / 3
Trigger Term Quality	Covers natural terms an analyst would say — 'sandbox', 'VM evasion', 'malware samples', 'Cuckoo', 'AnyRun', 'behavioral report', 'evasion indicators', 'anti-analysis' — plus scenario triggers like 'sample shows no or minimal activity in a sandbox'.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (malware sandbox-evasion analysis from Cuckoo/AnyRun reports) with distinct triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md
Commit: e612f49

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.