Individual skill
malware-analysis-orchestrator
Structured malware triage and reverse-engineering orchestration for PE, ELF, and Mach-O binaries with strict artifact dumping to a status folder. Use when requests involve malware sample analysis, strings triage, API/import analysis, behavioral hypothesis generation, component mapping, deep-analysis planning, Binary Ninja MCP usage, Ghidra MCP usage, or role-based orchestration (orchestrator/planner/reporter) with complete intermediate outputs.
agent_helpers/claude/skills/malware-analysis-orchestrator/SKILL.md
Source commit fa1f51b5f97d2606e534d513ba538d06cfb0596b
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Local scripts
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 330
- Repository last updated
- Mar 22, 2026
- License
- GPL-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 13,021 bytesSKILL.mdcore · 13,021 bytesSKILL.mdcore · 13,021 bytesassets/status_templates/00_sample_profile.mddoc · 367 bytesassets/status_templates/01_strings_raw.txtdoc · 57 bytesassets/status_templates/02_strings_interesting.mddoc · 131 bytesassets/status_templates/03_imports_raw.txtdoc · 57 bytesassets/status_templates/04_imports_interesting.mddoc · 136 bytesassets/status_templates/05_behavior_hypotheses.mddoc · 184 bytesassets/status_templates/06_component_inventory.mddoc · 79 bytesassets/status_templates/07_interaction_model.mddoc · 69 bytesassets/status_templates/08_deep_analysis_plan.mddoc · 218 bytesassets/status_templates/09_priority_queue.mddoc · 84 bytesassets/status_templates/10_reporting_draft.mddoc · 109 bytesassets/status_templates/CURRENT_STATE.jsonasset · 676 bytesassets/status_templates/INDEX.mddoc · 598 bytesassets/yara_rules/LICENSE-GPLv2asset · 18,047 bytesassets/yara_rules/antidebug_antivm.yarasset · 27,570 bytesassets/yara_rules/capabilities.yarasset · 23,295 bytesassets/yara_rules/crypto_signatures.yarasset · 76,593 bytesassets/yara_rules/packer_compiler_signatures.yarasset · 21,462 bytesreferences/agent-roles.mddoc · 1,888 bytesreferences/artifact-spec.mddoc · 2,871 bytesreferences/deep-analysis-checklist.mddoc · 2,196 bytesreferences/interesting-signals.mddoc · 6,015 bytesreferences/workflow.mddoc · 3,582 bytesscripts/build_hypothesis.pyruns · 15,766 bytesscripts/collect_imports.shruns · 2,660 bytesscripts/collect_strings.shruns · 3,738 bytesscripts/init_status_tree.shruns · 2,448 bytesscripts/rank_signals.pyruns · 11,523 bytesscripts/resolve_case.shruns · 899 bytesscripts/scan_capa.shruns · 4,981 bytesscripts/scan_yara.shruns · 1,831 bytesscripts/update_state.pyruns · 3,641 bytes
No licensed excerpt is available. You can inspect the pinned source.