analyzing-pdf-malware-with-pdfid
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
81
77%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-pdf-malware-with-pdfid/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines its security-focused niche of malicious PDF analysis. It names specific tools, concrete actions, and threat types while providing explicit activation triggers. The description is concise yet comprehensive, making it easy to distinguish from general PDF processing skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: analyzes malicious PDFs using named tools (PDFiD, pdf-parser, peepdf), identifies embedded JavaScript/shellcode/exploits/suspicious objects, determines attack vectors, and extracts embedded payloads. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes malicious PDFs to identify threats and extract payloads) and 'when' with an explicit activation clause: 'Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.' | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a user would say: 'PDF malware analysis', 'malicious document', 'PDF exploit', 'suspicious attachment', 'shellcode', 'JavaScript', plus tool names like PDFiD, pdf-parser, peepdf that a security analyst would reference. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on malicious PDF analysis with security-specific tools and terminology. Unlikely to conflict with general PDF processing skills due to the clear malware/security focus and named specialized tools. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
55%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides excellent actionable guidance with executable commands and well-sequenced workflows for PDF malware analysis. However, it is severely bloated with explanatory content Claude doesn't need (glossary tables, tool descriptions, concept definitions) and fails to leverage progressive disclosure by cramming everything into a single monolithic file. Trimming the explanatory sections and splitting reference material into linked files would significantly improve token efficiency.
Suggestions
Remove the 'Key Concepts' glossary table and 'Tools & Systems' descriptions entirely — Claude already knows what FlateDecode, PDF objects, and these tools are.
Move the 'Common Scenarios' section and 'Output Format' template into separate referenced files (e.g., SCENARIOS.md, REPORT_TEMPLATE.md) to reduce the main skill's token footprint.
Eliminate the inline risk assessment table in Step 1 — the PDFiD output comments already convey the same information more concisely.
Remove the 'When to Use' and 'Do not use' sections or compress them to a single line — the YAML description already covers activation context.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~300+ lines. It explains basic concepts Claude already knows (what a PDF Object is, what FlateDecode is, what OpenAction means), includes a full glossary table, and has extensive commentary that doesn't add actionable value. The risk assessment table, key concepts section, and tools descriptions are largely redundant for Claude. | 1 / 3 |
Actionability | The skill provides fully executable bash commands and Python scripts throughout. Commands are copy-paste ready with specific tool invocations, flags, and output parsing. The Python extraction scripts are complete and functional with proper imports and logic. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced from initial triage through report generation. Each step builds on the previous one's output. The scenario section includes explicit pitfalls to avoid, and the workflow naturally validates at each stage (PDFiD triage -> structure parsing -> JS extraction -> shellcode analysis -> file extraction -> reporting). | 3 / 3 |
Progressive Disclosure | This is a monolithic wall of content with no references to external files. The Key Concepts table, Tools & Systems section, Common Scenarios, and Output Format could all be split into separate reference files. Everything is inline in a single massive document with no navigation structure pointing to supplementary materials. | 1 / 3 |
Total | 8 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
888bbe4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.