Malware Analysis

Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

54 stars 3 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)
npx skills add gl0bal01/malware-analysis-claude-skills --skill malware-analysis
Manual install
git clone --depth 1 https://github.com/gl0bal01/malware-analysis-claude-skills.git /tmp/malware-analysis-claude-skills
mkdir -p ~/.claude/skills
cp -r /tmp/malware-analysis-claude-skills/. ~/.claude/skills/malware-analysis

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Malware Analysis Orchestrator

Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows.

## How This Works

You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator:

1. Determines which sub-skill to use based on your file type and intent
2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself
3. Records findings in a state file (`analysis_state.md`)
4. Recommends the next phase when the current one completes
5. Waits for your confirmation before proceeding

You never need to invoke sub-skills directly.

## Execution Model

- **Claude does the work on the host.** Hashing, `file`, PE parsing, strings, IOC extraction, macro/PDF/script deobfuscation, .NET decompilation, Procmon/Sysmon/tshark parsing, rule authoring and testing, report writing — all run by Claude with Bash. Do not turn a step into "ask the user to run X and paste the output" unless the tool is missing and cannot be installed.
- **The only thing the analyst does by hand is execute the sample in the isolated VM** and export text evidence. `malware-dynamic-analysis` produces the runbook for that.
Read the full skill on GitHub

Details

Skill name
malware-analysis
Repository
gl0bal01/malware-analysis-claude-skills
License
MIT
Repo updated
5 September 2026

FAQ

What does the Malware Analysis skill do?

Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

How do I install the Malware Analysis skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add gl0bal01/malware-analysis-claude-skills --skill malware-analysis. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Malware Analysis popular?

It lives in gl0bal01/malware-analysis-claude-skills, which has 54 GitHub stars and 3 forks.

Related skills

Secscan

51

atgreen/secscan-skill

In-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive → adversarial-verify → report — using Read/Grep/Glob (and optional subagents), no external tooling. Use when asked to "security scan", "find vulnerabilities", "SAST", "audit this code for security", or "secscan".

Security

Auditor Skill

63

solanabr/auditor-skill

**AUDIT SKILL** — Comprehensive on-chain Solana program auditor and full-stack security review for ANY programming language. USE FOR: auditing Solana/Anchor programs, reviewing smart contract security, checking for vulnerabilities (missing signers, unchecked accounts, arithmetic overflow, CPI attacks, PDA confusion, type cosplay, reinitialization, flash loan exploits, MEV, governance backdoors, timelock bypass), auditing TypeScript/Python/Go/Java/Ruby/PHP/any language, backend/frontend code review, supply chain safety, CI/CD and GitHub Actions workflow security (comment-triggered commands, pul

Security13

Security Scan

42

chaenmasahiro0425/claude-security-scan

開発者のPC・手元のgitリポジトリ・GitHub・Vercelと公開サイト・クラウド（AWS / Google Cloud / Azure / Cloudflare / Supabase）・Gmailを読み取り専用で横断スキャンし、重要度別のHTMLレポートと前回からの差分を出すスキル。「セキュリティチェックして」「セキュリティスキャン」「脆弱性ないか見て」「APIキー漏れてない？」「乗っ取られてないか確認」「新しく出たリスクだけ教えて」「毎週スキャンを設定して」等で使う。設定の変更・送信・削除はしない。直すときは1件ずつ利用者の承認を取る。

Security

Claude Pentest Skills

66

frendysanusi/claude-pentest-skills

Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation

Security12

R00 ComposioHQ Awesome Claude Skills Security

49

CraftsmanTuck/r08-composiohq-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from ComposioHQ/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Security Guide

139

jnMetaCode/shellward

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

SecurityIn 1 list23

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.