agentsclimarketplace
Sign in

Identifying file types and formats

Skill meltedinhex/analyst-ai-pack/skills/identifying-file-types-and-formats

Identifies a sample's true file type independent of its extension: matching magic bytes and structural signatures, detecting container/archive formats, and flagging extension-content mismatches used to disguise malware. Activates for requests to identify a file type, check magic bytes, or detect a disguised/spoofed extension.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill identifying-file-types-and-formats

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, 494 tokens by cl100k_base, as published. Nobody here has run it

Identifying File Types and Formats

When to Use

  • You receive an unknown sample and must determine what it actually is before choosing tools.
  • You suspect masquerading — a .pdf or .jpg that is really an executable or script.
  • You need to detect container formats (ZIP/OLE/ISO) that hide a payload.

Do not use the file extension or the OS-reported type as truth — adversaries rename executables and embed payloads; always confirm by content.

Prerequisites

  • file/libmagic or an equivalent magic-byte database; the sample handled inertly in the lab.

Safety & Handling

  • Never open the sample in its associated application during identification; read raw bytes only.
  • Keep the disguised extension in mind — a double extension or RTLO trick can mislead the eye.

Workflow

Step 1: Read the magic bytes

Inspect the leading bytes and known offset signatures (e.g., MZ, \x7fELF, %PDF, PK\x03\x04, OLE D0 CF 11 E0).

python scripts/analyst.py identify sample.dat

Step 2: Confirm structure

For container formats, confirm internal structure (ZIP central directory, OLE storage, ISO CD001 at 0x8001) rather than trusting the header alone.

Step 3: Compare against the claimed extension

Flag mismatches: a .jpg whose content is MZ, or a document that is actually a script. These are strong masquerading indicators.

Step 4: Route to the right analysis

Use the confirmed type to pick the correct workflow (PE static analysis, document analysis, archive extraction).

Validation

  • The detected type is confirmed by both magic bytes and structural checks, not magic alone.
  • Extension/content mismatches are explicitly reported.
  • The result correctly routes the sample to the appropriate analysis skill.

Pitfalls

  • Trusting the first 2 bytes only; some formats need offset or structural confirmation.
  • Missing polyglot files that are valid as two formats at once.
  • Overlooking nested containers (archive inside archive) that hide the real payload.

References

What ships with it: 3 files

4.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.