Malware analysis
AppSec Skills — 15 plug-and-play Claude Code security skills that audit, harden, and fix any website or app before you ship it. OWASP Top 10, auth, API, database, frontend, backend, cloud, dependencies, secrets, and pentest-style checks — all defensive, all evidence-based.
npx -y skills add Rootx202/appsec-skills --skill malware-analysisAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
3 things to look at
- 23 days oldThe repository was created 23 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Defensive triage for suspicious files, scripts, or dependencies the user has already encountered (e.g. a suspicious npm package, an unexpected script in a repo, a file behaving oddly). Use only to identify and explain suspicious behavior in code the user already has, to help them decide whether to remove/report it — never to create, improve, or "test" malicious payloads.
SKILL.md
2.7 KB, as published. Nobody here has run it
Malware Analysis — Defensive Triage for Suspicious Code
A strictly defensive skill: helping the user understand whether a file, script, or package already present in their project is malicious, and why, so they can remove it or report it.
When to use this
- The user suspects an npm/pip/other package added to their project
- An unfamiliar script exists (a postinstall script, a cron job, oddly obfuscated code) with no clear explanation
- A file behaves unexpectedly (unexplained network calls, modifying system files)
What This Skill Does
- Static triage. Read the provided code and look for common indicators:
- Network connections to domains/IPs unrelated to the package's stated purpose
- Excessive obfuscation with no legitimate reason for a simple package
- Reading sensitive environment variables (keys, tokens) and exfiltrating them
postinstall/preinstallscripts inpackage.jsonthat execute extra code on install- Modification of system files or configuration unrelated to the tool's stated function
- Explain in plain language. Describe what the suspicious code actually does, line by line where useful — without improving, "cleaning up," or making it more effective.
- Recommend next steps. Should it be removed immediately? Should any secrets be rotated because they may have already leaked? Is it worth reporting (to npm/PyPI security, GitHub Security Advisories, etc.)?
Report Format
File/Package: [name]
Suspicious Indicators: [list of indicators found]
What it does: [plain-language behavior description]
Risk Level: Critical/High/Medium/Low
Recommendation: [remove / rotate secrets / report / monitor]
Hard, Non-Negotiable Limits
- This skill is for analysis and understanding only — never for writing, improving, or "fixing" malicious code to make it work better.
- Never produce an "educational" or "test" version of the malicious code itself.
- Never explain how to bypass antivirus or detection tooling.
- If a request looks like it's asking to build a new malicious tool (rather than analyze something that already exists), decline and redirect to the other defensive scanning skills instead.
- When intent is unclear, ask for clarification: is this an existing file that needs analysis, or a request to create new code?