analyzing-pdf-malware-with-pdfid

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-pdf-malware-with-pdfid/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete commands and scripts and a clear step sequence, but it over-explains known concepts and fails to route detail to the existing bundle files, and the destructive workflow lacks explicit validation checkpoints.

Suggestions

Move the PDFiD keyword/risk tables and command syntax into references/api-reference.md and link to it, and point readers to scripts/agent.py for the extraction script instead of inlining it.

Add explicit validation checkpoints to the workflow (e.g., 'confirm the stream decompressed cleanly before analyzing it', 'verify the extracted object ID matches the OpenAction reference chain').

Remove or trim the Key Concepts table entries that restate concepts Claude already knows (PDF Object, FlateDecode, JBIG2) to tighten token efficiency.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and actionable, but the 'Key Concepts' table explains PDF Object, FlateDecode, and JBIG2 — concepts Claude already knows — which the rubric explicitly penalizes, keeping it just below efficient.	3 / 5
Actionability	Provides fully executable, copy-paste-ready bash commands (pdfid, pdf-parser) and complete Python scripts for JS, embedded-PE, and URL extraction covering the common cases.	5 / 5
Workflow Clarity	A clear 6-step sequence exists, but this batch/destructive malware workflow lacks explicit validation checkpoints (e.g., confirm a stream decompressed before analyzing), which the rubric caps at 3.	3 / 5
Progressive Disclosure	Sectioned structure is present, but the body inlines API-reference-style content (PDFiD keyword tables, risk blocks, concepts) and a full extraction script instead of signaling the existing references/api-reference.md and scripts/agent.py bundle files.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, and complete, clearly stating both the capability and when to invoke it with distinct, low-conflict triggers. The only minor gap is the absence of file-extension and synonym trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across named tools — 'identify embedded JavaScript, shellcode, exploits, and suspicious objects', 'Determines the attack vector', 'extracts embedded payloads' — giving comprehensive coverage with no meaningful gaps.	5 / 5
Completeness	Explicitly answers both 'what' (analyzes malicious PDFs with named tools to identify/extract) and 'when' ('Activates for requests involving PDF malware analysis…') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural phrases ('PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage') but lacks synonyms and the .pdf file extension, so it falls just short of comprehensive coverage.	4 / 5
Distinctiveness Conflict Risk	A clear niche (static PDF malware triage 'without opening the document') with named tools and an explicit 'Do not use' boundary, giving minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-pdf-malware-with-pdfid/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.