agentsclimarketplace
Sign in

Analyze suspicious script or document

Skill gaelic-ghost/socket/skills/analyze-suspicious-script-or-document

Decode and analyze suspicious scripts and active documents without triggering them. Use for shell, AppleScript, JavaScript, Python, PowerShell, shortcuts, Office files, PDFs, profiles, macros, embedded objects, and staged payloads.From its SKILL.md

Install
npx -y skills add gaelic-ghost/socket --skill analyze-suspicious-script-or-document

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, as published. Nobody here has run it

Analyze Suspicious Script Or Document

Overview

Recover the execution chain as data. Use parsers and text extraction in isolation, avoid native handlers, and make each decoding transformation reproducible.

Read references/script-document-analysis.md for language and document-specific checks.

Workflow

  1. Preserve the original and identify the real container/type.
  2. Extract without activation.
    • List document members and relationships; extract text, metadata, macros, JavaScript, forms, links, embedded files, and external references with non-executing tooling.
    • Render URLs and commands as inert text.
  3. Normalize one layer at a time.
    • Decode base64/hex/URL escapes, string concatenation, compression, character arithmetic, environment substitution, and generated commands.
    • Record input, operation, tool, and output hash for every layer.
  4. Reconstruct control and data flow.
    • Identify entry conditions, interpreter, downloaded content, execution methods, persistence, credential/file access, network destinations, cleanup, and environment gates.
  5. Separate capability from execution.
    • State which branches are present, which inputs activate them, and which behaviors remain inferred.
  6. Route payloads.
    • Send recovered binaries to static/reverse analysis and use dynamic analysis only inside chosen isolation.

Guardrails

  • Do not paste decoded commands into an executing shell.
  • Do not enable macros, install profiles, follow links, or import shortcuts during static analysis.
  • Do not use a cloud document parser for private content without approval.

Output

Return container identity, recovered layers, execution chain, indicators, activation conditions, likely impact, uncertainty, and safe next step.

What ships with it: 2 files

1.2 KB alongside SKILL.md

agents/

references/

Gives 0 of the 12 instructions most docs writing skills give

Counted across 1,951 of the 3,904 authors here whose files we hold, read 2026-09-06

  • Use third-person for skill descriptionsin 54 of 1951, across 35 files
  • Start descriptions with Use whenin 43 of 1951, across 29 files
  • Run baseline scenarios before writing any skillin 40 of 1951, across 26 files
  • Use active voicein 40 of 1951, across 36 files
  • Map file responsibilities before defining tasksin 36 of 1951, across 29 files
  • Use checkbox syntax for tracking stepsin 35 of 1951, across 27 files
  • Ask one question at a timein 35 of 1951
  • Offer execution options after saving the planin 33 of 1951, across 24 files
  • Include complete code in every stepin 33 of 1951, across 27 files
  • Design units with clear boundaries and interfacesin 31 of 1951, across 23 files
  • Announce the skill usage at the startin 30 of 1951
  • Verify agent compliance after adding the skillin 29 of 1951, across 17 files

Said here and by no other author read

  • Extract content without activation
  • Render URLs as inert text
  • Normalize one layer at a time
  • Record input and output hashes
  • Reconstruct control and data flow
  • Separate capability from execution

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.

Keep looking

Skills are one crate of 626,194. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.