string-intelligence

Classify security-relevant string literals from decompiled functions into structured categories.

17|3|Updated Feb 22, 2026

Search Tags:#security #analysis #triage #taxonomy #decompiled #string

Ready to run

npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill string-intelligence

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: string-intelligence
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/string-intelligence
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill string-intelligence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Scan and classify string literals from decompiled code analysis to reveal security-relevant indicators such as URLs, registry keys, file paths, and error messages, enabling rapid triage and threat intel on binary modules.

Core Features & Use Cases

Deep analysis of per-function string literals across modules to categorize strings by security relevance.
Supports module-wide scans or targeted function-level queries, returning JSON outputs for automation.
Integrates with existing analysis DBs and taxonomy to surface high-risk strings in a readable format.

Quick Start

Run the analyze_strings_deep.py script on a module DB to enumerate and categorize strings.

Frequently Asked Questions about string-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I classify security-relevant strings from decompiled code?▼

To classify security-relevant strings from decompiled code, extract string literals from per-function analysis databases and apply a canonical taxonomy to categorize URLs, registry keys, file paths, and GUIDs for rapid triage.

What is the best way to extract URLs and registry keys from decompiled functions?▼

Extracting URLs and registry keys from decompiled functions involves scanning per-module analysis DBs containing string_literals data and categorizing matches against a security taxonomy to surface high-risk indicators.

Can I scan an entire binary module for threat intel indicators like file paths and GUIDs?▼

Yes, you can scan an entire binary module for threat intel indicators by running deep analysis scripts on the module database to enumerate and categorize string literals like file paths and GUIDs.

Does string classification for decompiled code work with targeted function-level queries?▼

String classification for decompiled code supports both module-wide scans and targeted function-level queries, returning structured JSON outputs to integrate high-risk string triage into automation workflows.

How do I prepare analysis databases before classifying decompiled string literals?▼

Before classifying decompiled string literals, you need existing per-module analysis databases containing string_literals data extracted from decompiled functions, which the classification taxonomy then processes.

What are the limitations of using a taxonomy to triage decompiled string literals?▼

Triage of decompiled string literals relies strictly on the string_literals data present in analysis DBs and the canonical taxonomy's pattern definitions, limiting results to recognized categories like URLs, registry keys, and file paths.