Forensics Osquery
AgentSecOps/SecOpsAgentKit
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.
Install Malware Analyst
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install aiskillstore/marketplace malware-analyst --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/sickn33/malware-analyst .claude/skills/malware-analyst && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .claude/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analystType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install aiskillstore/marketplace malware-analyst --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/sickn33/malware-analyst .agents/skills/malware-analyst && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .agents/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install aiskillstore/marketplace malware-analyst --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/sickn33/malware-analyst .cursor/skills/malware-analyst && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .cursor/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/aiskillstore/marketplace.git --path skills/sickn33/malware-analyst--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install aiskillstore/marketplace malware-analyst --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/sickn33/malware-analyst .gemini/skills/malware-analyst && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .gemini/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install aiskillstore/marketplace malware-analystInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/sickn33/malware-analyst .github/skills/malware-analyst && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .github/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add aiskillstore/marketplace --skill malware-analyst -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install aiskillstore/marketplace malware-analyst --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/aiskillstore/marketplace.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/sickn33/malware-analyst .opencode/skills/malware-analyst && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "malware-analyst" agent skill from https://github.com/aiskillstore/marketplace/tree/main/skills/sickn33/malware-analyst into .opencode/skills/malware-analyst/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "malware-analyst", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
malware-analyst- GitHub stars
- 430
- Used in
- 6 other repos
- Token cost
- ~1.7k tokens
- SKILL.md length
- 375 words
- Files
- 2
- Skills in repo
- 1,108
- Repo updated
- First seen
- Licence
- None found
At a glance
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.
- Works in 3 steps: Environment Setup → Execution → Documentation
- Tasks that involve Incident response
- SKILL.md covers Reporting Framework, Ethical Guidelines and Response Approach
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Malware Analyst is an agent skill from aiskillstore/marketplace. Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `skill-report.json`).
It sits in Security, covering Incident response, OSINT and Security operations. The repository describes itself as: Security-audited skills for Claude, Codex & Claude Code. One-click install, quality verified.
When your agent uses it
- Tasks that involve Incident response
- Tasks that involve OSINT
- Tasks that involve Security operations
Example prompts
- “/malware-analyst”
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Environment Setup
- Execution
- Documentation
What it can do on your machine
Read from SKILL.md and the folder at commit ad8daf7. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are yara and markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Malware Analyst loads about 1.7k tokens when it runs. Until then it costs about 91 tokens; SKILL.md has 375 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 375 words (~1,658 tokens).
- name
- malware-analyst
- metadata.model
- opus
Files
SKILL.md and 1 other file in skills/sickn33/malware-analyst of aiskillstore/marketplace.
- SKILL.md
- skill-report.json
Open the folder on GitHubat commit ad8daf7
Used in 6 other repositories
We found 15 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 6 other GitHub owners. This page covers the copy in aiskillstore/marketplace, which our catalogue first saw on October 7, 2026.
- sickn33/agentic-awesome-skillsskills/malware-analystplugins/agentic-awesome-skills/skills/malware-analyst+1 more
- rmyndharis/antigravity-skillsskills/malware-analyst
- agent-skills-hub/agent-skills-hubskills/malware-analyst
- lingxling/awesome-skills-cnantigravity-awesome-skills/skills/malware-analystantigravity-awesome-skills/plugins/agentic-awesome-skills/skills/malware-analyst+1 more
- benjaminasterA/antigravity-awesome-skillsskills/malware-analyst
- henryalouf/ruflow.agents/skills/malware-analyst.agents/skills/antigravity-awesome-skills/skills/malware-analyst+4 more
Compare with similar skills
Malware Analyst next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Malware Analyst this skillaiskillstore/marketplace | 430 | 6 repos | ~1.7k | Automated safety check: Pass | None | |
| Forensics OsqueryAgentSecOps/SecOpsAgentKit | 220 | 1 repos | ~4.9k | Automated safety check: Notes | Custom licence | |
| Ir VelociraptorAgentSecOps/SecOpsAgentKit | 220 | 1 repos | ~3.1k | Automated safety check: Pass | Custom licence | |
| Extracting Config From Agent Tesla Ratmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~1.8k | Automated safety check: Pass | Apache-2.0 | |
| Hunting For Webshell Activitymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~904 | Automated safety check: Pass | Apache-2.0 | |
| Building Threat Feed Aggregation With Mispmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.2k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Ir Velociraptor
AgentSecOps/SecOpsAgentKit
Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.
Extracting Config From Agent Tesla Rat
mukul975/Anthropic-Cybersecurity-Skills
Extracts embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis.
Hunting For Webshell Activity
mukul975/Anthropic-Cybersecurity-Skills
Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server…
Building Threat Feed Aggregation With Misp
mukul975/Anthropic-Cybersecurity-Skills
Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization…
Detecting Network Anomalies With Zeek
mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for…
More from aiskillstore/marketplace
All 1,108 skills in this repoCode Stats
aiskillstore/marketplace
Analyze codebase with tokei (fast line counts by language) and difft (semantic AST-aware diffs).
File Search
aiskillstore/marketplace
Modern file and content search using fd, ripgrep (rg), and fzf.
Data Processing
aiskillstore/marketplace
Process JSON with jq and YAML/TOML with yq. An agent skill from aiskillstore/marketplace.
Doc Scanner
aiskillstore/marketplace
Scans for project documentation files (AGENTS.md, CLAUDE.md, GEMINI.md, COPILOT.md, CURSOR.md, WARP.md, and 15+ other formats) and synthesizes guidance.
Find Replace
aiskillstore/marketplace
Modern find-and-replace using sd (simpler than sed) and batch replacement patterns.
Investigating Codebases
aiskillstore/marketplace
Automatically activated when user asks how something works, wants to understand unfamiliar code, needs to explore a new codebase, or asks questions like "where is X implemented?", "how does Y…
Related
Categories
Questions about Malware Analyst
What does Malware Analyst do?
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Malware Analyst is an agent skill from aiskillstore/marketplace. Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.
When should I use Malware Analyst?
Malware Analyst fits situations like: tasks that involve Incident response; tasks that involve OSINT; tasks that involve Security operations.
How do I install Malware Analyst in Claude Code?
Run `npx skills add aiskillstore/marketplace --skill malware-analyst -a claude-code`. Or copy the skill folder (skills/sickn33/malware-analyst in aiskillstore/marketplace) into .claude/skills/malware-analyst in your project. Claude Code loads it when a task matches its description.
How do I install Malware Analyst in Codex?
Run `npx skills add aiskillstore/marketplace --skill malware-analyst -a codex`. Or copy the skill folder (skills/sickn33/malware-analyst in aiskillstore/marketplace) into .agents/skills/malware-analyst in your project. Codex loads it when a task matches its description.
Can I use Malware Analyst in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aiskillstore/marketplace --skill malware-analyst -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/malware-analyst, .gemini/skills/malware-analyst, .github/skills/malware-analyst and .opencode/skills/malware-analyst in your project.
What does Malware Analyst need to run?
SKILL.md names no scripts, command-line tools or credentials: Malware Analyst is instructions for the agent only.
Does Malware Analyst access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Malware Analyst safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Malware Analyst use?
No licence was found for Malware Analyst or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Malware Analyst use?
About 1.7k tokens (SKILL.md is roughly 6.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Malware Analyst?
Skills that share tags, products or a category with Malware Analyst: Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars), Ir Velociraptor (AgentSecOps/SecOpsAgentKit, 220 stars), Extracting Config From Agent Tesla Rat (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Hunting For Webshell Activity (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Malware Analyst?
aiskillstore (a GitHub organization) maintains it in aiskillstore/marketplace, which has 430 GitHub stars. The repository holds 1,108 skills in this directory. The repository was last updated on October 7, 2026.
Source: aiskillstore/marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.