Not in the top 1,000 by GitHub stars
mrphrazer/agentic-malware-analysis
Agentic malware analysis environment with MCP-connected disassemblers, RE tooling, and structured workflows for Claude Code and Codex CLI.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
fa1f51b5f97d → fa1f51b5f97d
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → fa1f51b5f97d
No earlier version was observed for comparison.
agent_helpers/codex/skills/malware-analysis-orchestrator/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
fa1f51b5f97d → fa1f51b5f97d
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → fa1f51b5f97d
No earlier version was observed for comparison.
330GitHub stars
6stars in 7 days
2skills in this repository
0commits in 30 days
Heat
5.1- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- malware-analysis-orchestrator
agent_helpers/claude/skills/malware-analysis-orchestrator - malware-analysis-orchestrator
agent_helpers/codex/skills/malware-analysis-orchestrator
How it works
malware-analysis-orchestrator
When your agent uses it
Structured malware triage and reverse-engineering orchestration for PE, ELF, and Mach-O binaries with strict artifact dumping to a status folder. Use when requests involve malware sample analysis, strings triage, API/import analysis, behavioral hypothesis generation, component mapping, deep-analysis planning, Binary Ninja MCP usage, Ghidra MCP usage, or role-based orchestration (orchestrator/planner/reporter) with complete intermediate outputs.
What it loads into context
Frontmatter
95 tokensAlways available to the agent
SKILL.md
3,143 tokensWhen the skill is activated
Reference documents
4,961 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Overview
- Claude-Specific Guidance
- Required Rules
- Quick Start
- Workflow Decision Tree
- Tooling and Fallbacks
- Role-Oriented Execution Model
- Artifact Discipline
- Binary Ninja MCP Guidance
- Ghidra MCP Guidance
- Completion Criteria
- Expected Deliverable Style
Scripts executed separately
scripts/build_hypothesis.pyscripts/collect_imports.shscripts/collect_strings.shscripts/init_status_tree.shscripts/rank_signals.pyscripts/resolve_case.shscripts/scan_capa.shscripts/scan_yara.shscripts/update_state.py
Files
SKILL.mdcore13,021 bytesSKILL.mdcore13,021 bytesSKILL.mdcore13,021 bytesassets/status_templates/00_sample_profile.mddoc367 bytesassets/status_templates/01_strings_raw.txtdoc57 bytesassets/status_templates/02_strings_interesting.mddoc131 bytesassets/status_templates/03_imports_raw.txtdoc57 bytesassets/status_templates/04_imports_interesting.mddoc136 bytesassets/status_templates/05_behavior_hypotheses.mddoc184 bytesassets/status_templates/06_component_inventory.mddoc79 bytesassets/status_templates/07_interaction_model.mddoc69 bytesassets/status_templates/08_deep_analysis_plan.mddoc218 bytesassets/status_templates/09_priority_queue.mddoc84 bytesassets/status_templates/10_reporting_draft.mddoc109 bytesassets/status_templates/CURRENT_STATE.jsonasset676 bytesassets/status_templates/INDEX.mddoc598 bytesassets/yara_rules/LICENSE-GPLv2asset18,047 bytesassets/yara_rules/antidebug_antivm.yarasset27,570 bytesassets/yara_rules/capabilities.yarasset23,295 bytesassets/yara_rules/crypto_signatures.yarasset76,593 bytesassets/yara_rules/packer_compiler_signatures.yarasset21,462 bytesreferences/agent-roles.mddoc1,888 bytesreferences/artifact-spec.mddoc2,871 bytesreferences/deep-analysis-checklist.mddoc2,196 bytesreferences/interesting-signals.mddoc6,015 bytesreferences/workflow.mddoc3,582 bytesscripts/build_hypothesis.pyruns15,766 bytesscripts/collect_imports.shruns2,660 bytesscripts/collect_strings.shruns3,738 bytesscripts/init_status_tree.shruns2,448 bytesscripts/rank_signals.pyruns11,523 bytesscripts/resolve_case.shruns899 bytesscripts/scan_capa.shruns4,981 bytesscripts/scan_yara.shruns1,831 bytesscripts/update_state.pyruns3,641 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubmalware-analysis-orchestrator
When your agent uses it
Structured malware triage and reverse-engineering orchestration for PE, ELF, and Mach-O binaries with strict artifact dumping to a status folder. Use when requests involve malware sample analysis, strings triage, API/import analysis, behavioral hypothesis generation, component mapping, deep-analysis planning, Binary Ninja MCP usage, Ghidra MCP usage, or role-based orchestration (orchestrator/planner/reporter) with complete intermediate outputs.
What it loads into context
Frontmatter
95 tokensAlways available to the agent
SKILL.md
3,149 tokensWhen the skill is activated
Reference documents
4,961 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Overview
- Codex-Specific Guidance
- Required Rules
- Quick Start
- Workflow Decision Tree
- Tooling and Fallbacks
- Role-Oriented Execution Model
- Artifact Discipline
- Binary Ninja MCP Guidance
- Ghidra MCP Guidance
- Completion Criteria
- Expected Deliverable Style
Scripts executed separately
scripts/build_hypothesis.pyscripts/collect_imports.shscripts/collect_strings.shscripts/init_status_tree.shscripts/rank_signals.pyscripts/resolve_case.shscripts/scan_capa.shscripts/scan_yara.shscripts/update_state.py
Files
SKILL.mdcore13,015 bytesSKILL.mdcore13,015 bytesSKILL.mdcore13,015 bytesagents/openai.yamlasset247 bytesassets/status_templates/00_sample_profile.mddoc367 bytesassets/status_templates/01_strings_raw.txtdoc57 bytesassets/status_templates/02_strings_interesting.mddoc131 bytesassets/status_templates/03_imports_raw.txtdoc57 bytesassets/status_templates/04_imports_interesting.mddoc136 bytesassets/status_templates/05_behavior_hypotheses.mddoc184 bytesassets/status_templates/06_component_inventory.mddoc79 bytesassets/status_templates/07_interaction_model.mddoc69 bytesassets/status_templates/08_deep_analysis_plan.mddoc218 bytesassets/status_templates/09_priority_queue.mddoc84 bytesassets/status_templates/10_reporting_draft.mddoc109 bytesassets/status_templates/CURRENT_STATE.jsonasset676 bytesassets/status_templates/INDEX.mddoc598 bytesassets/yara_rules/LICENSE-GPLv2asset18,047 bytesassets/yara_rules/antidebug_antivm.yarasset27,570 bytesassets/yara_rules/capabilities.yarasset23,295 bytesassets/yara_rules/crypto_signatures.yarasset76,593 bytesassets/yara_rules/packer_compiler_signatures.yarasset21,462 bytesreferences/agent-roles.mddoc1,888 bytesreferences/artifact-spec.mddoc2,871 bytesreferences/deep-analysis-checklist.mddoc2,196 bytesreferences/interesting-signals.mddoc6,015 bytesreferences/workflow.mddoc3,582 bytesscripts/build_hypothesis.pyruns15,764 bytesscripts/collect_imports.shruns2,660 bytesscripts/collect_strings.shruns3,738 bytesscripts/init_status_tree.shruns2,448 bytesscripts/rank_signals.pyruns11,523 bytesscripts/resolve_case.shruns899 bytesscripts/scan_capa.shruns4,981 bytesscripts/scan_yara.shruns1,831 bytesscripts/update_state.pyruns3,641 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubSkills included
- malware-analysis-orchestrator
- malware-analysis-orchestrator
Repository facts
- License
- GPL-2.0
- Created
- Mar 18, 2026
- Last pushed
- Mar 22, 2026
- Forks
- 48
- Open issues
- 0
- Project activity
- Slowing
Before you install
Local scriptsAutomated signals, not a guarantee
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 4 notes
agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedagent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedagent_helpers/codex/skills/malware-analysis-orchestrator/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedagent_helpers/codex/skills/malware-analysis-orchestrator/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- No dangerous shell commands
- No hidden or obfuscated text
- No instruction overrides
- 18 executable scriptsin 18 files: malware-analysis-orchestrator/scripts/build_hypothesis.py:1 malware-analysis-orchestrator/scripts/collect_imports.sh:1 malware-analysis-orchestrator/scripts/collect_strings.sh:1 and 15 more
- 16 references to secretsin 8 files: malware-analysis-orchestrator/scripts/build_hypothesis.py:309 malware-analysis-orchestrator/scripts/build_hypothesis.py:309 malware-analysis-orchestrator/references/interesting-signals.md:60 and 5 more
- No requests to vote in Hot
Show all 300 signals by file
agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md
- Network accessline 119
- Malicious capabilities (55 rules) - Packer/compiler signatures (36 rules) Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`. - Network accessline 120
- Packer/compiler signatures (36 rules) Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`. 8. `capa` (Mandiant) -- automated capability identification mapped to MITRE ATT - Network accessline 121
Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`.
agent_helpers/claude/skills/malware-analysis-orchestrator/assets/yara_rules/LICENSE-GPLv2
- Network accessline 4
Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
agent_helpers/claude/skills/malware-analysis-orchestrator/assets/yara_rules/antidebug_antivm.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 15
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 16
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 17
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 26
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 27
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 28
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 37
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 38
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 39
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 48
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 49
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 50
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 58
meta: Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 59
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" weight = 1 - Network accessline 60
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 70
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 71
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 72
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 83
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 84
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 85
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 97
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 98
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 99
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 111
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 112
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 113
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 125
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 126
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 127
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 137
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 138
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 139
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 148
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 149
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 150
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 159
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 160
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 161
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 170
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 171
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 172
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 181
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 182
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 183
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 194
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 195
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 196
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 207
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 208
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 209
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 218
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 219
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 220
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 232
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 233
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 234
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 246
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 247
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 248
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 260
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 261
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 262
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 274
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 275
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 276
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 287
author = "Malware Utkonos" original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 288
original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 289
source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 299
author = "Malware Utkonos" original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 300
original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 301
source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 582
meta: Author = "http://twitter.com/j0sm1" - Network accessline 583
Author = "http://twitter.com/j0sm1" - Network accessline 595
meta: Author = "http://twitter.com/j0sm1" - Network accessline 596
Author = "http://twitter.com/j0sm1" - Network accessline 597
Description = "it's checked if UnhandledExceptionFilter is imported" Date = "20/04/2015" Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#UnhandledExceptionFilter" - Network accessline 599
Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#UnhandledExceptionFilter" - Network accessline 610
meta: Author = "http://twitter.com/j0sm1" - Network accessline 611
Author = "http://twitter.com/j0sm1" - Network accessline 612
Description = "it's checked if RaiseException is imported" Date = "20/04/2015" Reference = "http://waleedassar.blogspot.com.es/2012/11/ollydbg-raiseexception-bug.html" - Network accessline 614
Reference = "http://waleedassar.blogspot.com.es/2012/11/ollydbg-raiseexception-bug.html" - Network accessline 623
meta: Author = "http://twitter.com/j0sm1" - Network accessline 624
Author = "http://twitter.com/j0sm1" - Network accessline 625
Description = "it's checked if FindWindowA() is imported" Date = "20/04/2015" Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#OllyFindWindow" - Network accessline 627
Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#OllyFindWindow" - Network accessline 640
date = "2015-06" description = "Anti-debug process memory working set size check" reference = "http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/" - Network accessline 642
reference = "http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/"
agent_helpers/claude/skills/malware-analysis-orchestrator/assets/yara_rules/capabilities.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 822
description = "Match Winsock 2 API library declaration" method = "String match" reference = "https://github.com/dfirnotes/rules" - Network accessline 824
reference = "https://github.com/dfirnotes/rules" - Network accessline 839
description = "Match Windows Inet API library declaration" method = "String match" reference = "https://github.com/dfirnotes/rules" - Network accessline 841
reference = "https://github.com/dfirnotes/rules" - Network accessline 855
description = "Match Windows Inet API call" method = "String match, trim the As" reference = "https://github.com/dfirnotes/rules" - Network accessline 857
reference = "https://github.com/dfirnotes/rules" - Network accessline 873
description = "Match Windows Http API call" method = "String match, trim the As" reference = "https://github.com/dfirnotes/rules" - Network accessline 875
reference = "https://github.com/dfirnotes/rules" - Network accessline 889
meta: author="xorseed" reference= "https://stuff.rop.io/" - Network accessline 890
author="xorseed" reference= "https://stuff.rop.io/" strings: - Network accessline 891
reference= "https://stuff.rop.io/"
agent_helpers/claude/skills/malware-analysis-orchestrator/assets/yara_rules/crypto_signatures.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 301
author = "chort (@chort0)" description = "Look for RC6 magic constants in binary" reference = "https://twitter.com/mikko/status/417620511397400576" - Network accessline 302
description = "Look for RC6 magic constants in binary" reference = "https://twitter.com/mikko/status/417620511397400576" reference2 = "https://twitter.com/dyngnosis/status/418105168517804033" - Network accessline 303
reference = "https://twitter.com/mikko/status/417620511397400576" - Network accessline 304
reference2 = "https://twitter.com/dyngnosis/status/418105168517804033" - Network accessline 429
description = "Rule to detect DarkEYEv3 encrypted executables (often malware)" author = "Florian Roth" reference = "http://darkeyev3.blogspot.fi/" - Network accessline 430
author = "Florian Roth" reference = "http://darkeyev3.blogspot.fi/" date = "2015-05-24" - Network accessline 431
reference = "http://darkeyev3.blogspot.fi/" - Network accessline 1063
description = "Aria SBox 2" date = "2020-12" reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" - Network accessline 1064
date = "2020-12" reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" strings: - Network accessline 1065
reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" - Network accessline 1459
description = "Look for 128-bit key Chacha stream cipher constant" date = "2019-12" reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" - Network accessline 1460
date = "2019-12" reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" strings: - Network accessline 1461
reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" - Network accessline 1471
description = "Look for 256-bit key Chacha stream cipher constant" date = "2019-12" reference = "https://tools.ietf.org/html/rfc8439#page-8" - Network accessline 1472
date = "2019-12" reference = "https://tools.ietf.org/html/rfc8439#page-8" strings: - Network accessline 1473
reference = "https://tools.ietf.org/html/rfc8439#page-8" - Network accessline 1570
description = "Look for SipHash constants in big endian" date = "2020-07" reference = "https://131002.net/siphash/siphash.pdf#page=6" - Network accessline 1571
date = "2020-07" reference = "https://131002.net/siphash/siphash.pdf#page=6" strings: - Network accessline 1572
reference = "https://131002.net/siphash/siphash.pdf#page=6"
agent_helpers/claude/skills/malware-analysis-orchestrator/assets/yara_rules/packer_compiler_signatures.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 523
author = "_pusher_" date = "2016-01" description = "http://flatassembler.net" - Network accessline 524
date = "2016-01" description = "http://flatassembler.net" //strings: - Network accessline 525
description = "http://flatassembler.net"
agent_helpers/claude/skills/malware-analysis-orchestrator/references/deep-analysis-checklist.md
- Access to secretsline 65
[Credential-related source omitted]
agent_helpers/claude/skills/malware-analysis-orchestrator/references/interesting-signals.md
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/build_hypothesis.py
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/collect_imports.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/collect_strings.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/init_status_tree.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/rank_signals.py
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/resolve_case.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/scan_capa.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/scan_yara.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/claude/skills/malware-analysis-orchestrator/scripts/update_state.py
- Executable scriptline 1
#!/usr/bin/env python3
agent_helpers/codex/skills/malware-analysis-orchestrator/SKILL.md
- Network accessline 119
- Malicious capabilities (55 rules) - Packer/compiler signatures (36 rules) Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`. - Network accessline 120
- Packer/compiler signatures (36 rules) Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`. 8. `capa` (Mandiant) -- automated capability identification mapped to MITRE ATT - Network accessline 121
Rules sourced from [Yara-Rules/rules](https://github.com/Yara-Rules/rules) (GPL-2.0), stored in `assets/yara_rules/`.
agent_helpers/codex/skills/malware-analysis-orchestrator/assets/yara_rules/LICENSE-GPLv2
- Network accessline 4
Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
agent_helpers/codex/skills/malware-analysis-orchestrator/assets/yara_rules/antidebug_antivm.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 15
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 16
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 17
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 26
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 27
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 28
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 37
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 38
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 39
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 48
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 49
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 50
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 58
meta: Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 59
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" weight = 1 - Network accessline 60
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 70
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 71
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 72
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 83
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 84
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 85
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 97
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 98
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 99
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 111
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 112
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 113
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 125
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 126
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 127
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 137
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 138
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 139
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 148
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 149
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 150
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 159
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 160
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 161
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 170
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 171
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 172
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 181
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 182
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 183
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 194
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 195
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 196
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 207
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 208
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 209
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 218
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 219
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 220
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 232
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 233
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 234
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 246
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 247
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 248
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 260
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 261
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 262
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 274
weight = 1 Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 275
Author = "naxonez" reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 276
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 287
author = "Malware Utkonos" original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 288
original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 289
source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 299
author = "Malware Utkonos" original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 300
original_author = "naxonez" source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" strings: - Network accessline 301
source = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara" - Network accessline 582
meta: Author = "http://twitter.com/j0sm1" - Network accessline 583
Author = "http://twitter.com/j0sm1" - Network accessline 595
meta: Author = "http://twitter.com/j0sm1" - Network accessline 596
Author = "http://twitter.com/j0sm1" - Network accessline 597
Description = "it's checked if UnhandledExceptionFilter is imported" Date = "20/04/2015" Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#UnhandledExceptionFilter" - Network accessline 599
Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#UnhandledExceptionFilter" - Network accessline 610
meta: Author = "http://twitter.com/j0sm1" - Network accessline 611
Author = "http://twitter.com/j0sm1" - Network accessline 612
Description = "it's checked if RaiseException is imported" Date = "20/04/2015" Reference = "http://waleedassar.blogspot.com.es/2012/11/ollydbg-raiseexception-bug.html" - Network accessline 614
Reference = "http://waleedassar.blogspot.com.es/2012/11/ollydbg-raiseexception-bug.html" - Network accessline 623
meta: Author = "http://twitter.com/j0sm1" - Network accessline 624
Author = "http://twitter.com/j0sm1" - Network accessline 625
Description = "it's checked if FindWindowA() is imported" Date = "20/04/2015" Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#OllyFindWindow" - Network accessline 627
Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#OllyFindWindow" - Network accessline 640
date = "2015-06" description = "Anti-debug process memory working set size check" reference = "http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/" - Network accessline 642
reference = "http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/"
agent_helpers/codex/skills/malware-analysis-orchestrator/assets/yara_rules/capabilities.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 822
description = "Match Winsock 2 API library declaration" method = "String match" reference = "https://github.com/dfirnotes/rules" - Network accessline 824
reference = "https://github.com/dfirnotes/rules" - Network accessline 839
description = "Match Windows Inet API library declaration" method = "String match" reference = "https://github.com/dfirnotes/rules" - Network accessline 841
reference = "https://github.com/dfirnotes/rules" - Network accessline 855
description = "Match Windows Inet API call" method = "String match, trim the As" reference = "https://github.com/dfirnotes/rules" - Network accessline 857
reference = "https://github.com/dfirnotes/rules" - Network accessline 873
description = "Match Windows Http API call" method = "String match, trim the As" reference = "https://github.com/dfirnotes/rules" - Network accessline 875
reference = "https://github.com/dfirnotes/rules" - Network accessline 889
meta: author="xorseed" reference= "https://stuff.rop.io/" - Network accessline 890
author="xorseed" reference= "https://stuff.rop.io/" strings: - Network accessline 891
reference= "https://stuff.rop.io/"
agent_helpers/codex/skills/malware-analysis-orchestrator/assets/yara_rules/crypto_signatures.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 301
author = "chort (@chort0)" description = "Look for RC6 magic constants in binary" reference = "https://twitter.com/mikko/status/417620511397400576" - Network accessline 302
description = "Look for RC6 magic constants in binary" reference = "https://twitter.com/mikko/status/417620511397400576" reference2 = "https://twitter.com/dyngnosis/status/418105168517804033" - Network accessline 303
reference = "https://twitter.com/mikko/status/417620511397400576" - Network accessline 304
reference2 = "https://twitter.com/dyngnosis/status/418105168517804033" - Network accessline 429
description = "Rule to detect DarkEYEv3 encrypted executables (often malware)" author = "Florian Roth" reference = "http://darkeyev3.blogspot.fi/" - Network accessline 430
author = "Florian Roth" reference = "http://darkeyev3.blogspot.fi/" date = "2015-05-24" - Network accessline 431
reference = "http://darkeyev3.blogspot.fi/" - Network accessline 1063
description = "Aria SBox 2" date = "2020-12" reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" - Network accessline 1064
date = "2020-12" reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" strings: - Network accessline 1065
reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7" - Network accessline 1459
description = "Look for 128-bit key Chacha stream cipher constant" date = "2019-12" reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" - Network accessline 1460
date = "2019-12" reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" strings: - Network accessline 1461
reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html" - Network accessline 1471
description = "Look for 256-bit key Chacha stream cipher constant" date = "2019-12" reference = "https://tools.ietf.org/html/rfc8439#page-8" - Network accessline 1472
date = "2019-12" reference = "https://tools.ietf.org/html/rfc8439#page-8" strings: - Network accessline 1473
reference = "https://tools.ietf.org/html/rfc8439#page-8" - Network accessline 1570
description = "Look for SipHash constants in big endian" date = "2020-07" reference = "https://131002.net/siphash/siphash.pdf#page=6" - Network accessline 1571
date = "2020-07" reference = "https://131002.net/siphash/siphash.pdf#page=6" strings: - Network accessline 1572
reference = "https://131002.net/siphash/siphash.pdf#page=6"
agent_helpers/codex/skills/malware-analysis-orchestrator/assets/yara_rules/packer_compiler_signatures.yar
- Network accessline 1
/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 2
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. - Network accessline 523
author = "_pusher_" date = "2016-01" description = "http://flatassembler.net" - Network accessline 524
date = "2016-01" description = "http://flatassembler.net" //strings: - Network accessline 525
description = "http://flatassembler.net"
agent_helpers/codex/skills/malware-analysis-orchestrator/references/deep-analysis-checklist.md
- Access to secretsline 65
[Credential-related source omitted]
agent_helpers/codex/skills/malware-analysis-orchestrator/references/interesting-signals.md
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/build_hypothesis.py
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/collect_imports.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/collect_strings.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/init_status_tree.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/rank_signals.py
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/resolve_case.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/scan_capa.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/scan_yara.sh
- Executable scriptline 1
#!/usr/bin/env bash
agent_helpers/codex/skills/malware-analysis-orchestrator/scripts/update_state.py
- Executable scriptline 1
#!/usr/bin/env python3
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 40 facts
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:119Low confidence
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:120Low confidence
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:121Low confidence
- Access to secrets in prose of documentationmalware-analysis-orchestrator/references/deep-analysis-checklist.md:65Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/references/interesting-signals.md:60Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/references/interesting-signals.md:113Low confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:1High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:309High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:311High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:313High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/collect_imports.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/collect_strings.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/init_status_tree.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/rank_signals.py:1High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/scripts/rank_signals.py:78Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/scripts/rank_signals.py:85Low confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/resolve_case.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/scan_capa.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/scan_yara.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/update_state.py:1High confidence
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:119Low confidence
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:120Low confidence
- Network access in prose of the SKILL.mdmalware-analysis-orchestrator/SKILL.md:121Low confidence
- Access to secrets in prose of documentationmalware-analysis-orchestrator/references/deep-analysis-checklist.md:65Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/references/interesting-signals.md:60Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/references/interesting-signals.md:113Low confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:1High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:309High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:311High confidence
- Access to secrets in code of a file that runsmalware-analysis-orchestrator/scripts/build_hypothesis.py:313High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/collect_imports.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/collect_strings.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/init_status_tree.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/rank_signals.py:1High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/scripts/rank_signals.py:78Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuemalware-analysis-orchestrator/scripts/rank_signals.py:85Low confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/resolve_case.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/scan_capa.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/scan_yara.sh:1High confidence
- Executable script in code of a file that runsmalware-analysis-orchestrator/scripts/update_state.py:1High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
