analyzing-pdf-malware-with-pdfid
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
76
71%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-pdf-malware-with-pdfid/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines a specific security-focused niche (malicious PDF analysis), lists concrete tools and actions, and provides explicit activation triggers. It uses proper third-person voice throughout and would be easily distinguishable from general PDF processing skills. The description is concise yet comprehensive, covering capabilities, tools, and use cases effectively.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: analyzes malicious PDFs using named tools (PDFiD, pdf-parser, peepdf), identifies embedded JavaScript/shellcode/exploits/suspicious objects, determines attack vectors, and extracts embedded payloads. Very concrete and detailed. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes malicious PDFs using specific tools to identify threats and extract payloads) and 'when' ('Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage'). Explicit trigger guidance is present. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms: 'malicious PDF', 'PDF malware analysis', 'malicious document analysis', 'PDF exploit investigation', 'suspicious attachment triage', 'JavaScript', 'shellcode', 'exploits'. These are terms a user would naturally use when dealing with suspicious PDFs. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche: malicious PDF analysis is clearly different from general PDF processing (text extraction, form filling). The focus on malware, exploits, shellcode, and specific security tools like PDFiD and peepdf makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
42%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides highly actionable, executable guidance for PDF malware analysis with concrete commands and scripts. However, it is excessively verbose — the Key Concepts glossary, Tools & Systems descriptions, and detailed risk assessment tables explain things Claude already knows and consume significant token budget. The lack of progressive disclosure (everything in one monolithic file) and missing validation checkpoints in the workflow are notable weaknesses.
Suggestions
Remove the Key Concepts table and Tools & Systems section entirely — Claude already knows what PDF objects, FlateDecode, and these standard tools are.
Split the Common Scenarios, Output Format template, and detailed Python scripts into separate reference files (e.g., SCENARIOS.md, REPORT_TEMPLATE.md) and link to them from the main skill.
Add explicit validation checkpoints: after Step 1, include a decision point ('If PDFiD shows 0 for all HIGH RISK indicators, document as clean and stop'); after Step 3, verify JavaScript was successfully extracted before proceeding to shellcode analysis.
Condense the PDFiD risk assessment into a compact inline reference rather than a formatted box with full explanations of each keyword.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~300+ lines. It explains basic concepts Claude already knows (what a PDF Object is, what FlateDecode is, what OpenAction means), includes a full glossary table, and has extensive tool descriptions. The risk assessment table, key concepts section, and tools section add significant token overhead that could be eliminated or drastically reduced. | 1 / 3 |
Actionability | The skill provides fully executable bash commands and Python scripts throughout. Every step includes copy-paste ready code with specific tool invocations, flags, and expected outputs. The Python extraction scripts are complete and functional. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced and logically ordered from triage to reporting. However, there are no explicit validation checkpoints or feedback loops — for example, no step says 'verify extraction succeeded before proceeding' or 'if PDFiD shows no indicators, stop here.' Given this involves potentially dangerous malware analysis, missing safety validation caps this at 2. | 2 / 3 |
Progressive Disclosure | This is a monolithic wall of content with no references to external files. The Key Concepts table, Tools & Systems section, Common Scenarios, and Output Format could all be split into separate reference files. Everything is inline in a single massive document with no navigation structure pointing to supplementary materials. | 1 / 3 |
Total | 7 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.