analyzing-packed-malware-with-upx-unpacker

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a well-sequenced, validated unpacking workflow and copy-paste code. It loses points for re-explaining concepts Claude already knows and for failing to signal the existing bundle files that duplicate inlined content.

Suggestions

Trim or remove the 'Key Concepts' and 'Tools & Systems' sections, which define concepts (Packing, UPX, OEP, PUSHAD/POPAD, Magic Bytes) and tools Claude already knows.

Link the existing bundle files from the body — e.g., 'See references/api-reference.md for full UPX/DIE/pefile syntax and entropy thresholds' and 'See scripts/agent.py for an automated detection/unpacking helper' — and move the duplicated DIE/pefile/entropy/x64dbg detail into the reference file.

Move the full 'Output Format' template into a reference file, keeping only a short example inline, to reduce token weight on the overview.

Dimension	Reasoning	Score
Conciseness	The workflow code is lean, but the 'Key Concepts' and 'Tools & Systems' sections re-explain concepts Claude already knows (Packing, UPX, OEP, PUSHAD/POPAD, Magic Bytes, and per-tool descriptions), adding padding that could be trimmed.	3 / 5
Actionability	Fully executable, copy-paste ready guidance throughout: bash commands (diec, upx -d/-t), a complete pefile analysis script, a concrete header-repair Python script, and specific x64dbg/Scylla menu steps.	5 / 5
Workflow Clarity	Five clearly sequenced steps with an explicit validation step (Step 5 verifies the unpacked PE, imports, and size ratio) and feedback loops (retry upx -d after header repair; fall back to manual unpacking if repair fails).	5 / 5
Progressive Disclosure	Good section headers give structure, but the existing references/api-reference.md and scripts/agent.py are never linked from the body, and content duplicated in the reference file (DIE/pefile/entropy/x64dbg) is inlined rather than offloaded.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that clearly states both capability and usage triggers using third-person voice. It is specific to a well-defined niche and gives a malware analyst natural trigger phrases.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers... to recover the original executable for static analysis' — with comprehensive coverage of the niche including the tricky modified-header case.	5 / 5
Completeness	Explicitly answers both what ('Identifies and unpacks UPX-packed malware samples... to recover the original executable') and when ('Use when a sample shows high entropy, minimal imports... or when preparing a packed binary for disassembly').	5 / 5
Trigger Term Quality	Strong domain-natural trigger terms ('high entropy, minimal imports', 'LoadLibrary/GetProcAddress in its import table', 'disassembly in Ghidra or IDA'), but lacks file-extension variants like .exe and a few common synonyms.	4 / 5
Distinctiveness Conflict Risk	Clear niche (UPX-packed malware, modified magic bytes/headers) with distinct technical triggers, giving minimal conflict risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.