agentsclimarketplace
Sign in

Analyzing banking trojan webinjects

Skill meltedinhex/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects

Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-banking-trojan-webinjects

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 1 command, including `python scripts/analyst.py parse webinjects.txt`.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 436 tokens by cl100k_base, as published. Nobody here has run it

Analyzing Banking Trojan Webinjects

When to Use

  • You have a banking trojan webinject config (Zeus/Gozi/Dridex-style set_url/data_before/ data_inject blocks) and want to extract targeted institutions and injected code.
  • You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception).

Do not use this to deploy or test injects against live banking sites. This skill parses the config statically and executes nothing.

Prerequisites

  • The decoded webinject config text (decrypt the config first if needed).

Safety & Handling

  • Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs.

Workflow

Step 1: Parse webinject blocks

python scripts/analyst.py parse webinjects.txt

Parses set_url/data_before/data_inject/data_after blocks into structured entries with the targeted URL pattern and the injected snippet.

Step 2: Extract targets and exfil endpoints

List targeted institution URL patterns and any exfil endpoints referenced by the injected code.

Step 3: Classify the injection technique

Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the injected markup/JS.

Step 4: Defang and report

Defang URLs and summarize targeted banks and theft techniques.

Validation

  • Each webinject block is parsed into target URL + injection.
  • Exfil endpoints in injected code are extracted and defanged.
  • Injection techniques are classified from the snippet content.

Pitfalls

  • Encrypted/packed configs needing decryption before parsing.
  • Wildcard URL patterns matching broadly — note the scope.
  • Obfuscated injected JS hiding the true exfil endpoint.

References

What ships with it: 3 files

4.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Gives 0 of the 12 instructions most finance skills give in 436 tokens

Counted across 469 of the 469 authors here whose files we hold, read 2026-08-07

  • Extract date vendor amount and descriptionin 15 of 469, across 3 files
  • Scan folder for invoice filesin 14 of 469, across 2 files
  • Rename files to standard formatin 14 of 469, across 2 files
  • Show organization plan before movingin 14 of 469, across 2 files
  • Generate summary CSVin 14 of 469, across 2 files
  • Organize files by categoryin 13 of 469, across 1 file
  • Preserve original filesin 13 of 469, across 1 file
  • Flag files missing critical infoin 13 of 469, across 1 file
  • Produce the requested output filein 9 of 469, across 4 files
  • Build best, base, and worst case scenariosin 9 of 469, across 5 files
  • Implement backoff if rate limit errors occurin 8 of 469, across 3 files
  • Determine the weighted average cost of capitalin 8 of 469, across 4 files

Said here and by no other author read

  • Decode encrypted configs before parsing
  • Parse webinject blocks into structured entries
  • Extract targeted institution URL patterns
  • Extract exfil endpoints from injected code
  • Classify injection techniques from snippet content
  • Treat injected JS and HTML as malicious

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.