skills.rest
thienty1207
thienty1207COMMUNITY
Explore all skills by this author →
GitHub

malware-triage

Performs offline static triage of authorized malware samples with hashes, indicators, and containment guidance.

1|Updated Sep 10, 2026
Search Tags:#static analysis#incident response#containment#sha-256#malware analysis#threat triage#indicators of compromise
One-click install
npx skills add https://github.com/thienty1207/Hotel_Staff --skill malware-triage-thienty1207
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-triage
Source: https://github.com/thienty1207/Hotel_Staff/tree/main/.baron/core/skills/malware-triage
Command: npx skills add https://github.com/thienty1207/Hotel_Staff --skill malware-triage-thienty1207

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams and developers who receive a suspicious file or malware sample need a safe, structured way to classify it, extract indicators, and decide on containment without executing the artifact or risking their environment. ## Core Features & Use Cases - Static Indicator Extraction: Records SHA-256 hashes, file type, size, strings, headers, signatures, imports, domains, and suspicious configuration values without running the sample. - Safety-Bounded Workflow: Enforces hard rules against execution, detonation, network contact with attacker infrastructure, and credential storage, keeping analysis read-only and isolated. - Structured Reporting: Produces SCOPE, EVIDENCE, FINDINGS, UNKNOWN, CONTAINMENT, and VERIFICATION sections with confidence levels and reproducible offline checks. - Use Case: A developer finds a suspicious binary committed to a repository and needs hashes, static indicators, and containment recommendations mapped back to the affected source before remediation. ## Quick Start Ask the assistant to triage the suspicious file at a given path offline, providing its SHA-256 hash, static indicators, and containment recommendations without executing it.

Frequently Asked Questions about malware-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a suspicious file without executing it?▼

Static triage records the SHA-256 hash, size, file type, and path, then extracts strings, headers, signatures, imports, and indicators like domains or suspicious configuration values. The sample stays isolated and read-only throughout the analysis.

What indicators can static malware analysis extract?▼

Static analysis extracts domains, file paths, hashes, imports, certificate metadata, and suspicious configuration values from binaries, scripts, documents, and archives. Behavior is marked as observed, inferred, or unknown rather than guessed.

Can this skill run or detonate a malware sample?▼

No, dynamic analysis is prohibited by default. Executing a sample requires explicit authorization and a dedicated user-owned sandbox; the skill never detonates samples, contacts attacker infrastructure, or establishes persistence.

Does malware triage require installing analysis tools?▼

No tools are auto-installed and no services are started. The skill works with available metadata and static inspection, and reports unsupported formats or missing tools in the UNKNOWN output section.

What are the limitations of offline static malware analysis?▼

Static analysis cannot confirm runtime behavior, so unsupported formats, packed binaries, and unverified behavior are reported as unknown. It also cannot replace a full sandbox detonation when behavioral evidence is required.

Related Skills

Explore More Software Engineering Skills→
avibebuilderavibebuilder
113

give-plan

Create a reviewable implementation plan from repository files before coding.

Official
Intermediate
Atrium-HermesAtrium-Hermes

pvr-triage-monitor

Monitor private vulnerability reports and surface aging triage action items.

Community
Advanced
clawpod-appclawpod-app
46

threat-briefing

Generate structured threat intelligence briefings from current feeds and advisories.

Community
Advanced
Liberty91LTDLiberty91LTD
15

malware-analysis

Identify malware samples and extract static and dynamic indicators from reports.

Official
Intermediate