agentsclimarketplace
Sign in

Perform static malware analysis

Skill gaelic-ghost/socket/skills/perform-static-malware-analysis

Analyze a suspicious artifact for capabilities without executing it. Use for binaries, apps, packages, archives, scripts, libraries, extensions, firmware, or embedded payloads when metadata, signatures, imports, strings, resources, configuration, rules, obfuscation, and likely behavior must be inspected and deep binary work may hand off to reverse-engineering-skills.From its SKILL.md

Install
npx -y skills add gaelic-ghost/socket --skill perform-static-malware-analysis

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, 336 tokens by cl100k_base, as published. Nobody here has run it

Perform Static Malware Analysis

Overview

Build a capability hypothesis from preserved bytes and structure. Keep every source-level or behavioral claim bounded by what static evidence can actually prove.

Read references/static-analysis-layers.md for layered checks and escalation criteria.

Workflow

  1. Establish artifact identity and working copy.
  2. Inspect outer structure.
    • Identify formats, architectures, bundles, packages, sections, members, overlays, embedded resources, signatures, timestamps, and declared permissions.
  3. Extract low-risk indicators.
    • Collect imports/exports, linked libraries, symbols, strings, URLs/domains, paths, commands, mutex/service names, configuration, certificates, and persistence references.
  4. Inspect code and content shape.
    • Identify interpreters, entry points, packers/obfuscation, encrypted blobs, staged payloads, anti-analysis checks, and unusual executable mappings.
    • Use YARA-X or other local rules as evidence with rule/version recorded.
  5. Form capability hypotheses.
    • Map evidence to possible execution, persistence, discovery, credential, collection, command-and-control, exfiltration, or defense-evasion behavior.
    • Separate present code from reachable behavior and capability from observed execution.
  6. Escalate deliberately.
    • Use reverse-engineering-skills for control flow, decompilation, protocol/config recovery, or exact binary comparisons.
    • Use dynamic analysis only after isolation selection and a clear observation plan.

Output

Return identity, structure, indicators, likely capabilities, contradictory evidence, obfuscation/coverage limits, confidence, and the smallest next analysis step.

What ships with it: 2 files

957 B alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.