Skill template

Skill meltedinhex/analyst-ai-pack/templates/skill-template

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install

npx -y skills add meltedinhex/analyst-ai-pack --skill skill-template

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

One to three sentences describing what this skill does and the conditions under which an agent should activate it. Start with a verb, name the tools and artifacts involved, and end with the trigger phrasing (e.g. "Activates for requests involving ...").

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.3 KB, as published. Nobody here has run it

Skill Title

Replace every bracketed placeholder. Delete this quote block and the Safety & Handling section if the skill does not touch live malware samples. Keep section order.

When to Use

[Concrete trigger: a situation where this skill is the right tool]
[Another trigger]
[Another trigger]

Do not use for [explicit out-of-scope cases]; instead reach for [the correct skill].

Prerequisites

[Tool + minimum version, with install/download pointer]
[Lab/environment requirement]
[Prior knowledge or input artifact required]

Safety & Handling

(Sample-handling skills only — delete otherwise.)

Work only inside an isolated analysis VM with no path to production or the internet unless deliberately routed through a controlled gateway.
Store samples encrypted or in password-protected archives (password infected); never leave live samples loose on disk.
Defang indicators (hxxp://, 1.2.3[.]4) in any output that leaves the lab.
Never execute a sample on the host or detonate outside the sandbox.

Workflow

Step 1: [Action]

[What to do and why.]

# Real, runnable command — not pseudocode
tool --do-the-thing sample.bin

Step 2: [Action]

[Explanation.]

# Original example code

Step 3: [Action]