Malware Analyst

This one's for defensive security work when you need to tear apart suspicious executables. It walks you through the full malware analysis workflow, from initial triage with file hashing and string extraction through static disassembly in IDA or Ghidra, then dynamic analysis in sandboxes. You get concrete checklists for identifying persistence mechanisms like registry run keys and scheduled tasks, plus evasion techniques like anti-VM checks and process hollowing. The real value is in the structured approach to IOC extraction and the reporting framework, so your findings are actually useful to the SOC team. It's explicitly scoped to defensive work only, no offensive operations, which is the right call for a public skill.

skills.sh installs: 349
GitHub stars: 39.4K
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add sickn33/antigravity-awesome-skills --skill malware-analyst --agent claude-code

Installs into .claude/skills of the current project.

Files

Defensive malware triage

Use only an authorized sample in a disposable isolated analysis environment. Disable shared folders, clipboard, host credentials and live outbound networking before dynamic execution; use simulated services. Do not upload private samples to public sandboxes without explicit disclosure approval. Static-tool parsers are also attack surfaces.

# File identification
file sample.exe
sha256sum sample.exe

# String extraction
strings -a sample.exe | head -100
FLOSS sample.exe  # Obfuscated strings

# Packer detection
diec sample.exe   # Detect It Easy
exeinfope sample.exe

# Import analysis
rabin2 -i sample.exe
dumpbin /imports sample.exe

Phase 3: Static Analysis

Load in disassembler: IDA Pro, Ghidra, or Binary Ninja
Identify main functionality: Entry point, WinMain, DllMain
Map execution flow: Key decision points, loops
Identify capabilities: Network, file, registry, process operations
Extract IOCs: C2 addresses, file paths, mutex names

SKILL.md on GitHub

Details

Repository: github.com/sickn33/antigravity-awesome-skills
First seen: Jun 3, 2026