analyzing-packed-malware-with-upx-unpacker
Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.
64
77%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-packed-malware-with-upx-unpacker/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific niche (UPX/packer removal for malware analysis), lists concrete capabilities including edge cases (modified UPX headers), and provides explicit activation triggers. It uses proper third-person voice throughout and would be easily distinguishable from other skills in a large skill library.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: identifies packed samples, unpacks UPX-packed malware, handles modified UPX headers, exposes original executable code for static analysis. These are concrete, well-defined capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (identifies and unpacks UPX-packed and other packed malware, handles modified UPX headers) and 'when' ('Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis'). | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'UPX', 'packed malware', 'unpacking', 'UPX decompression', 'packer removal', 'packed samples', 'static analysis', 'modified UPX headers'. Good coverage of terms a reverse engineer would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche — UPX unpacking and malware packer removal is a very specific domain unlikely to conflict with other skills. The triggers are domain-specific (UPX, packer removal, malware unpacking) and clearly scoped. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
55%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides excellent actionable guidance with executable code and a well-structured workflow with validation, but is severely undermined by verbosity. Significant portions (glossary, tool descriptions, scenario walkthrough, output template) either duplicate information Claude already knows or restate the workflow. The monolithic structure with no progressive disclosure makes this a heavy context-window consumer.
Suggestions
Remove the 'Key Concepts' glossary table entirely — Claude knows what packing, entropy, OEP, and PUSHAD/POPAD are.
Remove or drastically reduce the 'Tools & Systems' section since all tools are already listed in Prerequisites with sufficient context.
Move the 'Common Scenarios' section and 'Output Format' template to separate bundle files (e.g., SCENARIOS.md, OUTPUT_FORMAT.md) and reference them from the main skill.
Trim the 'When to Use' section to 2-3 bullet points — the negative case ('Do not use') is valuable but the positive triggers over-explain.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is excessively verbose. The 'Key Concepts' glossary table explains terms Claude already knows (what packing is, what PUSHAD/POPAD does, what entropy means). The 'Tools & Systems' section redundantly describes tools already mentioned in prerequisites. The 'Common Scenarios' section largely restates the workflow. The output format template adds significant length. Overall, this could be cut by 50%+ without losing actionable content. | 1 / 3 |
Actionability | The skill provides fully executable Python scripts and bash commands throughout. The header repair script is concrete and copy-paste ready, the entropy analysis script is complete, and the validation script is executable. The manual unpacking steps with x64dbg are specific with exact UI actions. | 3 / 3 |
Workflow Clarity | The 5-step workflow is clearly sequenced with explicit validation at Step 5. There's a clear fallback path: try standard UPX → repair headers → manual unpacking with debugger. The validation step checks entropy, imports, and file sizes. The scenario section provides an error recovery flow (repair fails → fall back to manual unpacking). | 3 / 3 |
Progressive Disclosure | This is a monolithic wall of text with no references to external files. The Key Concepts table, Tools & Systems section, Common Scenarios, and Output Format template could all be split into separate reference files. With no bundle files provided and everything inline, the skill is ~200+ lines when it could be a concise overview pointing to supporting materials. | 1 / 3 |
Total | 8 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
0445030
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.