Home / gl0bal01 / malware-analysis-claude-skills · GitHub

CLAUDE.mdA

CLAUDE.md from gl0bal01/malware-analysis-claude-skills is a CLAUDE.md file: the standing instructions Claude Code reads in that repo.

Install it, pinned
mdr add gl0bal01/malware-analysis-claude-skills/CLAUDE.md@git:20260905.e1d9a1a

Pins git:20260905.e1d9a1a in mdr.lock. Pin the fingerprint instead.

Audit grade
A, 14 of 14 checks passed
Kind
CLAUDE.md file
Repository
gl0bal01/malware-analysis-claude-skills
Path
CLAUDE.md
Versions recorded
5
Latest version
git:20260905.e1d9a1a, committed Sep 5, 2026
First version recorded
Mar 15, 2026
Size
7,212 bytes
Repository stars
54
License
MIT

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

## Project Overview

This is a **Claude skills package for malware analysis** — not a traditional software project. It contains 6 SKILL.md files (1 orchestrator + 5 sub-skills) with supporting references, templates, and scripts that make Claude perform every phase of the malware analysis lifecycle itself (static tooling, evidence parsing, rule authoring, report writing). The only manual step is executing the sample in the analyst's isolated VM. There is no build system; the only tests are the `--self-test` flags on the Python scripts.

## Repository Structure

The root `SKILL.md` is the **orchestrator** — the single entry point for all malware analysis. It routes to the 5 sub-skills based on file type and user intent, manages analysis state across phases in `analysis_state.md`, and supports multi-sample batch workflows. Users don't need to invoke sub-skills directly.

Each sub-skill is a self-contained directory with a `SKILL.md` (the skill prompt) plus optional `references/`, `assets/`, and `scripts/` subdirectories:
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint
mdr add gl0bal01/malware-analysis-claude-skills/CLAUDE.md@sha256:739a0be7b295cab1

The line at the top of this page pins the label git:20260905.e1d9a1a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_bzkd5sxjldksujig.svg)](https://markdownregistry.com/a/art_bzkd5sxjldksujig)

9 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 5 versions of this file, between Mar 15, 2026 and Sep 5, 2026, about one every 44 days.

versioncommittedcommitsizeaudit
git:20260905.e1d9a1a latest2026-09-05 e1d9a1a 7,212 BA view · diff
git:20260905.fd80b2a2026-09-05 fd80b2a 6,103 BA view · diff
git:20260412.09f91e42026-04-12 09f91e4 4,976 BA view · diff
git:20260315.2f4ad4c2026-03-15 2f4ad4c 4,597 BA view · diff
git:20260315.ae7ff682026-03-15 ae7ff68 4,956 BA view

Audit of the latest version

A  14 of 14 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
  • pass: Size between 200 bytes and 200 KB (7212 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No credential-shaped string
  • pass: No instruction to send local credentials anywhere
  • pass: No text hidden with inline styles
  • pass: No prompt-injection phrasing
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No link to a raw IP address
  • pass: No script tag

Source

GitHub

gl0bal01/malware-analysis-claude-skills · 54 stars · license MIT · pushed 2026-09-05 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_bzkd5sxjldksujig
GET https://markdownregistry.com/api/v1/resolve?ref=gl0bal01/malware-analysis-claude-skills/CLAUDE.md
GET https://markdownregistry.com/api/v1/blob/739a0be7b295cab1841b237028dcacaa9cd209bfd55e245d308008b2d794efd7

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: what a CLAUDE.md file is · keeping AGENTS.md and CLAUDE.md in sync · which agent file does what.

More from gl0bal01/malware-analysis-claude-skills

malware-analysis SKILL.md skill
gl0bal01/malware-analysis-claude-skills · SKILL.md · Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report…
git:20260905.e1d9a1a · audit A · 54 stars
detection-engineer SKILL.md skill
gl0bal01/malware-analysis-claude-skills · detection-engineer/SKILL.md · Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for…
git:20260905.e1d9a1a · audit A · 54 stars
malware-dynamic-analysis SKILL.md skill
gl0bal01/malware-analysis-claude-skills · malware-dynamic-analysis/SKILL.md · Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped…
git:20260905.e1d9a1a · audit A · 54 stars
malware-report-writer SKILL.md skill
gl0bal01/malware-analysis-claude-skills · malware-report-writer/SKILL.md · Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to…
git:20260905.e1d9a1a · audit A · 54 stars
malware-triage SKILL.md skill
gl0bal01/malware-analysis-claude-skills · malware-triage/SKILL.md · Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown…
git:20260905.e1d9a1a · audit A · 54 stars
specialized-file-analyzer SKILL.md skill
gl0bal01/malware-analysis-claude-skills · specialized-file-analyzer/SKILL.md · Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell…
git:20260905.e1d9a1a · audit F · 54 stars

Every file in gl0bal01/malware-analysis-claude-skills

Other files named CLAUDE.md

CLAUDE.md CLAUDE.md file
affaan-m/ecc · CLAUDE.md
git:20261020.9471ef4 · audit A · 299,696 stars
CLAUDE.md CLAUDE.md file
firecrawl/firecrawl · CLAUDE.md
git:20261008.5a75dca · audit A · 199,595 stars
CLAUDE.md CLAUDE.md file
garrytan/gstack · CLAUDE.md
git:20261107.ef99eb5 · audit A · 140,694 stars
CLAUDE.md CLAUDE.md file
juliusbrussee/caveman · CLAUDE.md
git:20261106.af560e1 · audit B · 118,366 stars
CLAUDE.md CLAUDE.md file
addyosmani/agent-skills · CLAUDE.md
git:20260720.8fd2081 · audit A · 113,383 stars
CLAUDE.md CLAUDE.md file
nexu-io/open-design · CLAUDE.md
git:20260430.9b57c22 · audit B · 106,541 stars
CLAUDE.md CLAUDE.md file
pbakaus/impeccable · CLAUDE.md
git:20261105.71dfd50 · audit A · 106,186 stars
CLAUDE.md CLAUDE.md file
debpalash/voicestudio · CLAUDE.md
git:20261104.c2998f6 · audit A · 102,675 stars

Browse by kind, by grade A, or by owner.