malware-analysis

Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a dense, highly actionable six-phase malware-analysis playbook with executable commands, validation gates, and well-organized external references. Its main weakness is verbosity — repeated gating refrains and a decorative architecture diagram compete for context without adding executable value.

Suggestions

Consolidate the recurring 'MUST/禁止' gating language and '补丁 N' callouts into a single rules section; reference it instead of restating in every phase to cut token cost.

Remove or compress the ASCII 'SentinelHive' multi-agent architecture diagram, which is decorative rather than executable guidance.

Move the '反分析技术速查' speed-lookup table into references/anti-analysis-techniques.md to keep SKILL.md a true overview.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and command-heavy assuming Claude's competence, but the body is long with repeated MUST/禁止 refrains, recurring '补丁 N' callouts, and a decorative ASCII multi-agent architecture diagram that could be trimmed.	3 / 5
Actionability	Provides fully executable, copy-paste-ready commands across all phases (file/rabin2/floss/diec, YARA and Sigma templates with MITRE IDs, specific API breakpoints and Evidence slots), covering the common analysis cases.	5 / 5
Workflow Clarity	A clearly sequenced six-phase workflow with explicit validation checkpoints, feedback loops (IAT-repair failure → dynamic bypass, self-check → stop), and a pre-completion self-check checklist for this destructive/batch context.	5 / 5
Progressive Disclosure	Body is an overview that signals one-level-deep references to verified local bundle files (yara-sigma-rules.md, sandbox-orchestration.md, anti-analysis-techniques.md) plus cross-skill cookbooks; mostly well split, with minor inline reference-style bulk (the speed-lookup table).	4 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise yet specific, naming multiple concrete capabilities and a clear 'Use when' trigger. It distinguishes itself well from sibling skills and would naturally surface for malware-analysis requests.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across the malware-analysis domain — 'static, dynamic, and behavioral techniques', 'IOC extraction', 'YARA or Sigma rules', 'sandboxing', and 'anti-analysis behavior' — giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (the analysis techniques enumerated) and 'when' via a concrete 'Use when analyzing suspected malware…' trigger clause.	5 / 5
Trigger Term Quality	Strong natural keywords ('malware', 'YARA', 'Sigma', 'sandboxing', 'IOC extraction', 'anti-analysis'), but missing common synonyms or short forms a user might say (e.g. 'malware samples', 'threat intel').	4 / 5
Distinctiveness Conflict Risk	Occupies a clear, narrow niche (malware analysis) with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/malware-analysis/SKILL.md
Commit: 3ae5c59

Reviewed: 30 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.