analyzing-packed-malware-with-upx-unpacker
Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.
67
81%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific technical niche (UPX unpacking for malware analysis), lists concrete capabilities including edge cases (modified UPX headers), and provides explicit trigger conditions. It uses proper third-person voice throughout and includes natural keywords that malware analysts would use when requesting this type of assistance.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: identifies packed samples, unpacks UPX-packed malware, handles modified UPX headers, exposes original executable code for static analysis. These are concrete, well-defined capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (identifies and unpacks UPX-packed and other packed malware, handles modified UPX headers) and 'when' ('Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis'). | 3 / 3 |
Trigger Term Quality | Includes strong natural trigger terms users would actually say: 'UPX', 'packed malware', 'unpacking', 'UPX decompression', 'packer removal', 'packed samples', 'static analysis', 'modified UPX headers'. Good coverage of how analysts would phrase these requests. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focusing specifically on UPX packing/unpacking in the malware analysis domain. Very unlikely to conflict with other skills given the specific technical focus on packed executables and UPX decompression. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
62%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides excellent actionable guidance with executable code and a well-structured multi-step workflow including validation and fallback paths. However, it is significantly bloated with redundant sections (Key Concepts glossary, Tools & Systems descriptions, repeated scenario walkthrough) that explain things Claude already knows, nearly doubling the token cost without proportional value. Splitting reference material into separate files would improve both conciseness and progressive disclosure.
Suggestions
Remove the 'Key Concepts' glossary table entirely — Claude already knows what packing, OEP, entropy, and PUSHAD/POPAD are.
Remove or drastically reduce the 'Tools & Systems' section since all tools are already described in Prerequisites and used in the workflow steps.
Move the 'Common Scenarios' section and 'Output Format' template to separate referenced files (e.g., SCENARIOS.md, REPORT_TEMPLATE.md) to reduce the main skill's token footprint.
Consolidate the 'Common Scenarios' section with the main workflow — it largely repeats Steps 1-5 with minor additions about pitfalls that could be inline warnings in the workflow itself.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is excessively verbose. The 'Key Concepts' glossary table explains terms Claude already knows (what packing is, what PUSHAD/POPAD are, what entropy means). The 'Tools & Systems' section redundantly describes tools already mentioned in prerequisites. The 'Common Scenarios' section largely repeats the workflow steps. The output format template, while useful, adds significant length. Overall, this could be cut by 40-50% without losing actionable content. | 1 / 3 |
Actionability | The skill provides fully executable Python scripts and bash commands throughout. The pefile-based entropy analysis, header repair script, and validation script are all copy-paste ready with concrete code. The manual unpacking steps with x64dbg, while necessarily textual, are specific and step-by-step with exact UI actions. | 3 / 3 |
Workflow Clarity | The 5-step workflow is clearly sequenced with logical progression from identification through validation. Step 5 explicitly validates the unpacked binary by checking entropy, imports, and file size. The workflow includes fallback paths (Step 2 fails → Step 3 header repair → Step 4 manual unpacking) creating a clear decision tree with error recovery. | 3 / 3 |
Progressive Disclosure | The content is a monolithic document with no references to external files. The Key Concepts table, Tools & Systems section, and detailed Common Scenarios section could all be split into separate reference files. For a skill of this length (~200+ lines), the lack of any content separation is a missed opportunity, though the internal section organization is reasonable. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
0f429d0
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.