analyzing-ransomware-encryption-mechanisms

Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ransomware-encryption-mechanisms/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A technically rich, actionable ransomware-analysis skill with strong code examples, but it buries its safety validation outside the workflow and fails to point at its own reference bundle, leaving overlap and navigation gaps.

Suggestions

Add an explicit validation checkpoint early in the Workflow (e.g. 'Before testing decryption, work on file copies and confirm the method on a known-plaintext pair') to satisfy the destructive-operation requirement and raise workflow_clarity.

Link references/api-reference.md from the body (e.g. 'See references/api-reference.md for full PyCryptodome/Volatility syntax and the known-schemes table') and move the duplicated scheme table out of SKILL.md to reduce redundancy.

Trim the Key Concepts entries that re-explain well-known crypto primitives (ECB, CSPRNG, key schedule) to only the ransomware-specific implication.

Dimension	Reasoning	Score
Conciseness	Mostly lean, code-and-table driven prose that earns its place, but the Key Concepts table explains crypto basics (ECB, CSPRNG, key schedule) Claude already knows and the encryption-schemes table duplicates content in references/api-reference.md.	4 / 5
Actionability	Provides concrete, executable Python (pefile import detection, AES/ECB/XOR tests, Volatility commands, NoMoreRansom URLs); the decompiled C in Step 3 is labeled pseudocode and a few offsets are family-dependent, keeping it just short of fully copy-paste ready.	4 / 5
Workflow Clarity	Six steps are clearly sequenced, but this destructive/batch skill (testing decryption on files) lacks explicit validation checkpoints embedded in the workflow; safety guidance lives only in the 'Do not use' note and Pitfalls, so the destructive-operation cap applies.	3 / 5
Progressive Disclosure	A references/api-reference.md bundle exists but is never linked or signaled from the body, and the body inlines overlapping API/scheme content that belongs in that reference; structure is present but navigation is not clearly signaled.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states concrete capabilities and explicit activation triggers within a well-scoped ransomware cryptanalysis niche. Minor keyword-synonym coverage is the only gap.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('Analyzes encryption algorithms, key management, and file encryption routines', 'assess decryption feasibility, identify implementation weaknesses, and support recovery efforts') plus named algorithms (AES, RSA, ChaCha20), giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what ('Analyzes encryption algorithms, key management...') and when ('Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Good natural keyword coverage ('ransomware cryptanalysis', 'encryption analysis', 'key recovery assessment', 'ransomware decryption feasibility'), but lacks synonyms and file-extension variants that would push it to a 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (ransomware encryption/cryptanalysis) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ransomware-encryption-mechanisms/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.