Malware Analysis Static
Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.
Install
npx skills add guelfoweb/malware-analysis-static --skill malware-analysis-staticgit clone --depth 1 https://github.com/guelfoweb/malware-analysis-static.git /tmp/malware-analysis-static
mkdir -p ~/.claude/skills
cp -r /tmp/malware-analysis-static/. ~/.claude/skills/malware-analysis-staticPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Malware Analysis Static Before starting, show this warning: `Warning: malware analysis should be performed only on an isolated lab machine or disposable VM, never on a personal or production workstation.` ## Startup 1. Create or reuse a case directory. 2. Create or read `AGENTS.md` and `REPORT.md`. 3. Preserve the original sample before substantive analysis. ## Scope Static analysis and reverse engineering for: - Windows PE, DLL, driver, and .NET assemblies - Linux ELF and macOS Mach-O binaries - Android APKs and embedded native libraries - Office/OLE/OOXML/RTF documents, VBA, VBS, JS, HTA, WSF, PowerShell - HTML, HTM, MHTML, SVG, XML, XSL, webshells, and source-code droppers - scripts in BAT, CMD, shell, Python, PHP, Perl, Ruby, Lua, AutoIt, Node.js, JSP, ASP, ASPX, and similar formats - extracted, embedded, decoded, dropped, downloaded, or chained stages Do not execute malware unless the user explicitly authorizes dynamic analysis in an isolated disposable lab. ## Load The Right Playbook Keep this file loaded as the core workflow. Load only the playbook needed for the current sample or stage: - Android APK: `references/apk.md` - Windows PE, DLL, driver, .NET: `references/pe-dotnet.md` - Office, VBA, VBS, JS, HTA, WSF, PowerShell, script droppers: `references/office-script.md` - HTML, web payloads, source-code droppers, webshells: `references/web-payload.md` - ELF, Mach-O, Unix shell payloads: `references/unix-binary.md`
Details
- Skill name
malware-analysis-static- Repository
- guelfoweb/malware-analysis-static
- Repo updated
- 27 April 2026
FAQ
What does the Malware Analysis Static skill do?
Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.
How do I install the Malware Analysis Static skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add guelfoweb/malware-analysis-static --skill malware-analysis-static. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Malware Analysis Static popular?
It lives in guelfoweb/malware-analysis-static, which has 12 GitHub stars and 4 forks.
Related skills
Security Bluebook Builder
8SHADOWPR0/security-bluebook-builder
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.
Security Scan
20Ray0907/security-scan
Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.
My Security Auditor
10leomarviegas/my-security-auditor
Comprehensive authorized security audit skill covering web, APIs, cloud, Kubernetes, mobile, AI/LLM, microservices, SaaS (multi-tenancy, SSO, BYOK), plus red/blue/purple team operations. Integrates OWASP (Top 10, API/Mobile/LLM/Cloud/K8s, ASVS, SAMM, WSTG, MASVS), MITRE ATT&CK + D3FEND, OSSTMM with RAV, NIST RMF/CSF, FAIR, ISO 27001 family, CVSS/EPSS/SSVC, Zero Trust (800-207, CISA ZTMM), SABSA, CIS, CSA CCM, SOC 1/2/3, PCI-DSS v4.0.1, GDPR/LGPD/CCPA/HIPAA privacy, customer trust deliverables (DPAs, CAIQ/SIG, VDPs), SOC operations, detection engineering, threat hunting, adversary emulation (CA
Security Research
22rhysha/claude-security-research-skill
Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon
Repo Seed
10EricSanchezok/repo-seed
Seed, audit, adopt, and progressively evolve an agent-native repository with risk-triggered specs, durable decisions, resident governance skills, capability state, deterministic gates, and safe upgrades. Use when initializing or upgrading a repository, when an unmanaged repository grows complex, or when delivery, ownership, security, release, or incident signals suggest a governance capability is missing.
Move Auditor
20pantheraudits/move-auditor
Audits Move contracts (Sui & Aptos) for security bugs.
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.