[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P93ANKK677DDKS30VBCRFD":3,"skill-same:01M6P93ANKK677DDKS30VBCRFD":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":26,"commitSha":47,"skillDirectory":48,"forksCount":13,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M6P93ANKK677DDKS30VBCRFD","malware-analysis",null,"Analyze suspected malware through static, dynamic, and behavioral techniques: IOC extraction, YARA\u002FSigma rule authoring, sandbox orchestration, and anti-analysis detection.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmalware-analysis\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"malware analysis","malware","analysis","detection","static","techniques","reverse","authoring","main","community","ioc extraction","analyze","safe","yara","ioc","https","license","orchestration","sandbox","github","2026-11-10 10:12:30",false,"---\nname: malware-analysis\ndescription: \"Analyze suspected malware through static, dynamic, and behavioral techniques: IOC extraction, YARA\u002FSigma rule authoring, sandbox orchestration, and anti-analysis detection.\"\nrisk: safe\nsource: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\"\nsource_repo: \"zhaoxuya520\u002Freverse-skill\"\nsource_type: community\ndate_added: \"2026-08-25\"\nlicense: \"MIT\"\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE\"\n---\n# Malware Analysis\n## When to Use\n\n- Triaging a suspicious sample in a controlled environment.\n- Producing detections (YARA\u002FSigma) from observed behavior.\n\n\n## 适用场景\n\n- 恶意软件样本分析（PE\u002FELF\u002FMach-O\u002FAPK\u002F脚本）\n- YARA 规则编写与验证\n- Sigma 行为检测规则生成\n- 沙箱自动化分析编排\n- IOC 提取与威胁情报\n- 反分析技术检测与绕过\n\n## 六阶段分析流程\n\n### Phase 1: 初步分诊\n\n```bash\n# 快速静态检测\nfile sample.exe                      # 文件类型\nstrings sample.exe | grep -i \"http\\|cmd\\|powershell\\|base64\"  # 快速 IOCs\nrabin2 -zz sample.exe                # 字符串提取 + 交叉引用\nfloss sample.exe                     # 去混淆字符串提取（FireEye）\n\n# PE 头部分析\npecheck sample.exe                   # PE 结构验证\npescan sample.exe                    # 异常检测（节表、入口点）\ndiec sample.exe                      # Detect It Easy（壳\u002F编译器识别）\n\n# Hash 查询\nsha256sum sample.exe\n# → VirusTotal \u002F MalwareBazaar \u002F Triage 查询\n```\n\n```text\nTriage MUST 清单（Issue #65）：\n□ 文件类型：EXE \u002F DLL \u002F SYS \u002F .NET \u002F 脚本(bat|ps1|vba) \u002F 其他\n□ 架构 x86\u002Fx64\u002FARM；查壳（DIE 等）与编译语言线索\n□ DLL\u002FSYS：导入表与导出表并列检查（见 Phase 2 硬门）\n□ .NET：无传统 IAT → 走 dnSpy\u002FIL\u002F元数据等价锚点（见 Phase 2）\n□ 脚本\u002F宏\u002FDLL 专项 P0：见 nonpe-format-cookbook U–AV（E-batch-deobf \u002F E-ps-decode \u002F E-vba-pcode \u002F E-dll-*）\n```\n\n### Phase 1b: 脱壳与 IAT 处理（有壳时 · Issue #65）\n\n```text\n□ 无壳 \u002F .NET → 跳到 Phase 2\n□ 有壳：尝试脱壳（授权隔离环境）→ 尝试修复 IAT\n  - x86：ImportREC（或等价）；x64：Scylla（或等价）。禁止 64 位死磕 ImportREC\n□ 【IAT 修复铁律】优先自动\u002F半自动修复；若工具报错或修复后无法运行：\n  - 立即终止继续静态 IAT 修复\n  - MUST 记录 E-iat-repair-fail（命令、工具、现象）\n  - 转入 Phase 3 动态：API 断点（如 bp CreateFile）\u002F 硬件断点 \u002F 内存搜索抓取导入\n  - 这不算跳过导入表：路径已尝试并记 Evidence\n□ 【补丁 6】脱壳+修 IAT 后闪退\u002F蓝屏（疑 CRC\u002F大小自校验）：\n  - 放弃继续静态修文件；记 E-self-check-crash 或并入 E-iat-repair-fail\n  - 转 Phase 3：对 CreateFile \u002F GetFileSize \u002F 哈希相关 API 下断\n□ 用户指令可行性（§0.5）：加壳时用户抢跑「先别脱壳先看导入表」→ 说明阻塞 + 请确认；强制则记 quality=unreadable\u002Fpacked，禁止冒充完成有意义 IAT\n□ 用户要求重做「IAT 修复 \u002F 导入表检查」：MUST 重做被点名步骤（或经确认的前提协商结果），禁止换无关步骤冒充\n```\n\n### Phase 2: 静态分析\n\n```text\n反汇编\u002F反编译：\n□ IDA Pro \u002F Ghidra: 深度反编译\n□ radare2: CLI 快速分析\n□ x64dbg: Windows GUI 调试器\n\n重点分析区域：\n□ 入口点（Entry Point）→ 初始化逻辑\n□ 导入表 → API 用途推断（CreateRemoteThread=注入, CryptEncrypt=勒索）\n   **MUST（硬门）**：执行 rabin2 -i \u002F IDA imports \u002F pecheck 等价命令，将导入表分类摘要写入 Evidence（E-imports）后才能进入 Phase 3（除非已记 E-iat-repair-fail 并走动态旁路，见 Phase 1b）\n   分类至少覆盖：网络 \u002F 文件 \u002F 加密 \u002F 进程注入 \u002F 注册表 \u002F 其他可疑 API\n   解析失败或表为空：仍 MUST 记录失败输出，禁止静默跳过\n   **DLL\u002FSYS**：MUST 并列记录导出表 Evidence（E-exports，`rabin2 -E` 或等价）\n   **.NET**：无传统 IAT 时 MUST 用 dnSpy\u002FIL\u002F元数据\u002F程序集引用与敏感 API 摘要作为等价锚点，写入 E-imports \u002F E-triage-imports 语义槽\n   **干净导入表**：仅基础 DLL、几乎无业务 API → MUST 注明动态加载嫌疑（LoadLibrary\u002FGetProcAddress），SHOULD 转入 Phase 3 抓内存 API；若见哈希解析特征 → E-api-hash（补丁 N）\n   **宽字符串（T）**：ASCII strings 无 IOC 时 MUST 再试 UTF-16（strings -el \u002F IDA unicode）\n   **签名（F）**：有签名仍 MUST SigCheck；伪造\u002F吊销不降威胁等级\n   用户要求「重做导入表检查」：MUST 重做本项（阻塞时先走可行性门闩协商），禁止改换其他步骤冒充完成\n   **高危 API 组合（补丁 8）**：表过长时优先输出恶意组合簇（如 FindWindow+WriteProcessMemory+CreateRemoteThread），过滤纯系统基础调用噪声\n□ 资源段 → 嵌入 Payload（.rsrc 节）\n□ 字符串表 → URL\u002FC2\u002F文件路径\u002FBase64 blob\n□ TLS 回调 → 调试器启动前执行\n```\n\n### Phase 3: 沙箱动态分析\n\n```text\n自动化沙箱：\n□ Joe Sandbox \u002F ANY.RUN \u002F Triage: 商业沙箱\n□ CAPE Sandbox: 开源 + YARA 集成（推荐）\n□ ASD Azul: 开源恶意软件分析平台（2026 新发布）\n□ Cuckoo Sandbox: 经典开源（逐步被 CAPE 取代）\n\n调试起手式（补丁 7+10 · MUST 顺序，用户态调试器）：\n□ ① TLS 回调断点 → ② 入口点 EP 断点 → ③ 敏感 API 断点 → ④ ExitProcess\u002F退出路径保底断点\n□ ExitProcess 触发时：不急着重启；立即 dump memory，路径写入 Evidence（补丁 10）\n\n监控重点：\n□ 进程创建: CreateProcess \u002F ShellExecute\n□ 文件操作: WriteFile → 勒索? DeleteFile → Wiper?\n□ 注册表: Run\u002FRunOnce 持久化\n□ 网络: HTTP\u002FDNS → C2 通信\n□ 内存: VirtualAllocEx → 进程注入\n□ 服务: CreateService → 持久化\n□ IAT 修复失败 \u002F 自校验闪退样本：敏感 API + CreateFile\u002FGetFileSize 断点 \u002F 硬件执行断点 \u002F 内存搜索\n\n无行为应急分支（MUST）：\n□ 沙箱无行为、秒退或无限休眠 → 检查反调试\u002F反虚拟机（CPUID、计时、环境特征）\n□ 尝试硬件断点绕过、补丁检测点、或换物理机\u002F更高保真环境\n□ 将「无行为 + 条件」写入 Evidence；禁止无条件写成「样本无害」\n\n时间盒（补丁 9 · SHOULD 默认，可覆盖）：\n□ 静态深挖约 15 分钟无关键路径 → 强制转入本 Phase 动态\n□ 动态单步约 200 条指令无恶意线索 → 强制回静态字符串\u002F交叉引用重锚\n\n反调试\u002F混淆旁路（Issue #65 A–T · 详见 reverse-engineering\u002Fanti-analysis.md 菜谱）：\n□ P0：CPUID \u002F RDTSC \u002F PEB \u002F NtQueryInformationProcess → 记录检测点后 lab 绕过或换环境（E-anti-debug-*）\n□ P0：干净 IAT → API 哈希动态解析（bp GetProcAddress，E-api-hash）\n□ P0：strings 空 → 串解密例程 + 宽字符串 UTF-16（E-string-decrypt \u002F E-wide-strings）\n□ P0：可疑签名 → SigCheck；无效\u002F吊销不降威胁（E-sig-forge）\n□ P1：进程名扫描 \u002F VEH \u002F int3·DR \u002F 重叠节 \u002F Overlay \u002F .rsrc \u002F Delay-Load\n□ H\u002FS 平坦化与不透明谓词 → ollvm-deobfuscation.md（不在此复制长文）\n□ 绕过失败也写 Evidence；禁止反调试退出 = 样本无害\n\n非 PE \u002F 脚本 \u002F DLL 补洞（Issue #65 U–AV · 详见 reverse-engineering\u002Freferences\u002Fnonpe-format-cookbook.md）：\n□ bat\u002Fcmd：SET 拼接还原（U）→ E-batch-deobf；UTF-16 BOM（V）；REM\u002FGOTO 淹没（W）\n□ PowerShell：多层 Base64\u002FGzip（X）逐层 Evidence；IEX 拼接\u002F反转（Z）  # security-allowlist: SEC005\n□ VBA：Stomping\u002FP-Code（AA）；Chr\u002FBase64（AB）；自修改宏（AC）\n□ DLL：TLS+DllMain（AJ）；导出异常\u002F无导出（AK\u002FAL）；Delay-Load 见 A–T R（AM）；侧加载\u002F反射（AO\u002FAP）\n□ JS\u002FAPK\u002F驱动：路由 js-reverse \u002F apk-reverse \u002F kernel-driver-reverse + cookbook，不在此复制长文\n```\n\n### Phase 4: YARA 规则编写\n\n```yara\n\u002F\u002F 规则结构\nrule MalwareFamily_Example {\n    meta:\n        description = \"检测 Example 恶意软件家族\"\n        author = \"分析者\"\n        date = \"2026-05\"\n        severity = \"high\"\n        hash = \"d41d8cd98f00b204e9800998ecf8427e\"\n        mitre_id = \"T1055\"  \u002F\u002F Process Injection\n\n    strings:\n        \u002F\u002F 字符串匹配\n        $str1 = \"C2_SERVER_URL\" ascii wide\n        $str2 = \"payload.dat\" ascii\n\n        \u002F\u002F 十六进制匹配\n        $hex1 = { 8B 45 ?? 50 FF 15 [4] 85 C0 }\n        \u002F\u002F 操作码序列: mov eax, [ebp-?]; push eax; call [import]; test eax, eax\n\n        \u002F\u002F 正则匹配\n        $re1 = \u002Fhttps?:\\\u002F\\\u002F[a-z0-9.-]+\\\u002F[a-z]{3,8}\\.php\u002F ascii\n\n    condition:\n        \u002F\u002F 组合条件\n        uint16(0) == 0x5A4D and     \u002F\u002F MZ 头\n        filesize \u003C 500KB and\n        (2 of ($str*) or $hex1)\n}\n```\n\n### Phase 5: Sigma 规则生成\n\n```yaml\n# 行为检测规则\ntitle: Suspicious Process Injection via CreateRemoteThread\nid: 5a3d2c1b-1234-5678-9abc-def012345678\nstatus: experimental\ndescription: 检测使用 CreateRemoteThread 的进程注入行为\nauthor: 分析者\ndate: 2026\u002F05\u002F25\ntags:\n    - attack.t1055          # Process Injection\n    - attack.t1055.001      # DLL Injection\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - 'CreateRemoteThread'\n            - 'VirtualAllocEx'\n            - 'WriteProcessMemory'\n    condition: selection\nfalsepositives:\n    - 合法的调试工具\nlevel: high\n```\n\n### Phase 6: IOC 提取与情报\n\n```text\nIOC 类型分类：\n□ 网络 IOC:\n  - IP: C2 地址（注意时效性）\n  - Domain: DGA 算法生成的域名（rsnkfda.com, xpqmje.net）\n  - URL: Payload 托管地址\n  - User-Agent: 自定义 UA 字符串\n\n□ 主机 IOC:\n  - 文件路径: %APPDATA%\\Microsoft\\Crypto\\RSA\\*.dat\n  - 注册表: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\n  - Mutex: Global\\{GUID} 互斥体名称\n  - 服务名: 伪装成系统服务的名称\n\n□ 行为 IOC:\n  - MITRE ATT&CK 技术 ID (T1055, T1003, T1571...)\n  - Sigma 规则 → SIEM 集成\n  - YARA 规则 → 端点检测\n\n□ 静态 IOC:\n  - 编译时间戳（可伪造）\n  - PDB 路径（含开发者信息）\n  - 节名异常（非标准 .text\u002F.data）\n  - 导入表异常组合（如勒索软件 CryptEncrypt + DeleteShadowCopies）\n```\n\n## 反分析技术速查\n\n| 技术 | 检测方法 | YARA 特征 |\n|------|---------|----------|\n| 虚拟机检测 | WMI Win32_BIOS\u002FVideoController\u002FProcessor | `Win32_` 字符串 + 特定厂商名 |\n| 沙箱检测 | 磁盘 \u003C 60GB, RAM \u003C 2GB, 单核 CPU | GlobalMemoryStatusEx 调用模式 |\n| 调试器检测 | IsDebuggerPresent, CheckRemoteDebuggerPresent | PEB.BeingDebugged 偏移访问 |\n| 定时逃逸 | Sleep(300000) 后执行恶意行为 | NtDelayExecution 长参数 |\n| 地理位置检测 | 检查键盘布局\u002F时区 → 排除 CIS 国家 | GetKeyboardLayoutList 调用 |\n| 父进程检测 | explorer.exe vs cmd.exe | 进程名字符串比较 |\n| API 直接 syscall | 绕过 EDR hook | syscall 指令 + SSN 解析 |\n\n## 多 Agent 自动化分析 (SentinelHive 架构)\n\n```text\n┌─────────────────────────────────────────────────┐\n│                  Hive Director                    │\n│          (Claude Opus 编排 + 仲裁)                │\n└──────┬──────┬──────┬──────┬──────┬───────┘\n       │      │      │      │      │\n   ┌───┘  ┌───┘  ┌───┘  ┌───┘  ┌───┘\n   ▼      ▼      ▼      ▼      ▼      ▼\nTriage  RE    Behav  Intel  Detect Remed\n 快速   反编译  行为   威胁   规则   修复\n 分诊   静态   动态   情报   YARA  方案\n                          Sigma\n```\n\n## 工具链\n\n| 工具 | 用途 | 获取 |\n|------|------|------|\n| Ghidra \u002F IDA Pro | 深度反编译 | ghidra-sre.org |\n| CAPE Sandbox | 开源恶意软件沙箱 | GitHub: kevoreilly\u002FCAPEv2 |\n| ASD Azul | 大规模自动化分析 | GitHub: ASD |\n| YARA | 模式匹配规则引擎 | `pip install yara-python` |\n| Sigma | SIEM 行为检测规则 | GitHub: SigmaHQ\u002Fsigma |\n| FLOSS | 去混淆字符串提取 | `pip install flare-floss` |\n| Detect It Easy | 壳\u002F编译器检测 | GitHub: horsicq\u002FDetect-It-Easy |\n| pe-sieve | 进程内存扫描 | GitHub: hasherezade\u002Fpe-sieve |\n| VirusTotal API | 多引擎扫描 | virustotal.com |\n| MalwareBazaar | 恶意软件样本库 | bazaar.abuse.ch |\n\n## 参考\n\n- `references\u002Fyara-sigma-rules.md` — YARA + Sigma 编写方法论\n- `references\u002Fsandbox-orchestration.md` — 沙箱编排与自动化\n- `references\u002Fanti-analysis-techniques.md` — 94 种反分析技术检测\n- `..\u002Freverse-engineering\u002Freferences\u002Fre-agent-workflow.md` — IAT 铁律与六阶段门闩（Issue #65）\n- `..\u002Freverse-engineering\u002Fanti-analysis.md` — Agent 响应菜谱 A–T（反调试\u002F混淆旁路）\n- `..\u002Freverse-engineering\u002Freferences\u002Fnonpe-format-cookbook.md` — 非 PE\u002F多格式菜谱 U–AV（脚本\u002F宏\u002FJS\u002F驱动\u002FDLL\u002FAndroid）\n- `..\u002Freverse-engineering\u002Freferences\u002Follvm-deobfuscation.md` — 平坦化\u002F不透明谓词（H\u002FS）\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 导入表 MUST 检查是否已执行并写入 Evidence（E-imports 或 .NET 等价锚点）？DLL\u002FSYS 是否含 E-exports？\n- [ ] 若 IAT 修复失败或自校验闪退：是否记录 E-iat-repair-fail \u002F E-self-check-crash 并转入动态？\n- [ ] 重做请求是否回到被点名步骤或经确认的前提协商？阻塞时是否说明+请确认而非偷换步骤？\n- [ ] 动态是否按 TLS→EP→敏感 API→ExitProcess 保底顺序预置断点？时间盒\u002F高危 API 组合是否按旁路处理？\n- [ ] 反调试\u002F混淆（A–T）是否按 anti-analysis 菜谱记录 Evidence？签名无效是否未错误降级威胁？\n- [ ] 脚本\u002F宏\u002FDLL 等非 PE 类型是否按 U–AV cookbook 记录对应 Evidence（如 E-batch-deobf \u002F E-ps-decode \u002F E-vba-pcode \u002F E-dll-*）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Never detonate live samples outside isolated, disposable VMs.\n- Anti-VM techniques can stall or mislead automated sandboxes.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n","# Malware Analysis\n## When to Use\n\n- Triaging a suspicious sample in a controlled environment.\n- Producing detections (YARA\u002FSigma) from observed behavior.\n\n\n## 适用场景\n\n- 恶意软件样本分析（PE\u002FELF\u002FMach-O\u002FAPK\u002F脚本）\n- YARA 规则编写与验证\n- Sigma 行为检测规则生成\n- 沙箱自动化分析编排\n- IOC 提取与威胁情报\n- 反分析技术检测与绕过\n\n## 六阶段分析流程\n\n### Phase 1: 初步分诊\n\n```bash\n# 快速静态检测\nfile sample.exe                      # 文件类型\nstrings sample.exe | grep -i \"http\\|cmd\\|powershell\\|base64\"  # 快速 IOCs\nrabin2 -zz sample.exe                # 字符串提取 + 交叉引用\nfloss sample.exe                     # 去混淆字符串提取（FireEye）\n\n# PE 头部分析\npecheck sample.exe                   # PE 结构验证\npescan sample.exe                    # 异常检测（节表、入口点）\ndiec sample.exe                      # Detect It Easy（壳\u002F编译器识别）\n\n# Hash 查询\nsha256sum sample.exe\n# → VirusTotal \u002F MalwareBazaar \u002F Triage 查询\n```\n\n```text\nTriage MUST 清单（Issue #65）：\n□ 文件类型：EXE \u002F DLL \u002F SYS \u002F .NET \u002F 脚本(bat|ps1|vba) \u002F 其他\n□ 架构 x86\u002Fx64\u002FARM；查壳（DIE 等）与编译语言线索\n□ DLL\u002FSYS：导入表与导出表并列检查（见 Phase 2 硬门）\n□ .NET：无传统 IAT → 走 dnSpy\u002FIL\u002F元数据等价锚点（见 Phase 2）\n□ 脚本\u002F宏\u002FDLL 专项 P0：见 nonpe-format-cookbook U–AV（E-batch-deobf \u002F E-ps-decode \u002F E-vba-pcode \u002F E-dll-*）\n```\n\n### Phase 1b: 脱壳与 IAT 处理（有壳时 · Issue #65）\n\n```text\n□ 无壳 \u002F .NET → 跳到 Phase 2\n□ 有壳：尝试脱壳（授权隔离环境）→ 尝试修复 IAT\n  - x86：ImportREC（或等价）；x64：Scylla（或等价）。禁止 64 位死磕 ImportREC\n□ 【IAT 修复铁律】优先自动\u002F半自动修复；若工具报错或修复后无法运行：\n  - 立即终止继续静态 IAT 修复\n  - MUST 记录 E-iat-repair-fail（命令、工具、现象）\n  - 转入 Phase 3 动态：API 断点（如 bp CreateFile）\u002F 硬件断点 \u002F 内存搜索抓取导入\n  - 这不算跳过导入表：路径已尝试并记 Evidence\n□ 【补丁 6】脱壳+修 IAT 后闪退\u002F蓝屏（疑 CRC\u002F大小自校验）：\n  - 放弃继续静态修文件；记 E-self-check-crash 或并入 E-iat-repair-fail\n  - 转 Phase 3：对 CreateFile \u002F GetFileSize \u002F 哈希相关 API 下断\n□ 用户指令可行性（§0.5）：加壳时用户抢跑「先别脱壳先看导入表」→ 说明阻塞 + 请确认；强制则记 quality=unreadable\u002Fpacked，禁止冒充完成有意义 IAT\n□ 用户要求重做「IAT 修复 \u002F 导入表检查」：MUST 重做被点名步骤（或经确认的前提协商结果），禁止换无关步骤冒充\n```\n\n### Phase 2: 静态分析\n\n```text\n反汇编\u002F反编译：\n□ IDA Pro \u002F Ghidra: 深度反编译\n□ radare2: CLI 快速分析\n□ x64dbg: Windows GUI 调试器\n\n重点分析区域：\n□ 入口点（Entry Point）→ 初始化逻辑\n□ 导入表 → API 用途推断（CreateRemoteThread=注入, CryptEncrypt=勒索）\n   **MUST（硬门）**：执行 rabin2 -i \u002F IDA imports \u002F pecheck 等价命令，将导入表分类摘要写入 Evidence（E-imports）后才能进入 Phase 3（除非已记 E-iat-repair-fail 并走动态旁路，见 Phase 1b）\n   分类至少覆盖：网络 \u002F 文件 \u002F 加密 \u002F 进程注入 \u002F 注册表 \u002F 其他可疑 API\n   解析失败或表为空：仍 MUST 记录失败输出，禁止静默跳过\n   **DLL\u002FSYS**：MUST 并列记录导出表 Evidence（E-exports，`rabin2 -E` 或等价）\n   **.NET**：无传统 IAT 时 MUST 用 dnSpy\u002FIL\u002F元数据\u002F程序集引用与敏感 API 摘要作为等价锚点，写入 E-imports \u002F E-triage-imports 语义槽\n   **干净导入表**：仅基础 DLL、几乎无业务 API → MUST 注明动态加载嫌疑（LoadLibrary\u002FGetProcAddress），SHOULD 转入 Phase 3 抓内存 API；若见哈希解析特征 → E-api-hash（补丁 N）\n   **宽字符串（T）**：ASCII strings 无 IOC 时 MUST 再试 UTF-16（strings -el \u002F IDA unicode）\n   **签名（F）**：有签名仍 MUST SigCheck；伪造\u002F吊销不降威胁等级\n   用户要求「重做导入表检查」：MUST 重做本项（阻塞时先走可行性门闩协商），禁止改换其他步骤冒充完成\n   **高危 API 组合（补丁 8）**：表过长时优先输出恶意组合簇（如 FindWindow+WriteProcessMemory+CreateRemoteThread），过滤纯系统基础调用噪声\n□ 资源段 → 嵌入 Payload（.rsrc 节）\n□ 字符串表 → URL\u002FC2\u002F文件路径\u002FBase64 blob\n□ TLS 回调 → 调试器启动前执行\n```\n\n### Phase 3: 沙箱动态分析\n\n```text\n自动化沙箱：\n□ Joe Sandbox \u002F ANY.RUN \u002F Triage: 商业沙箱\n□ CAPE Sandbox: 开源 + YARA 集成（推荐）\n□ ASD Azul: 开源恶意软件分析平台（2026 新发布）\n□ Cuckoo Sandbox: 经典开源（逐步被 CAPE 取代）\n\n调试起手式（补丁 7+10 · MUST 顺序，用户态调试器）：\n□ ① TLS 回调断点 → ② 入口点 EP 断点 → ③ 敏感 API 断点 → ④ ExitProcess\u002F退出路径保底断点\n□ ExitProcess 触发时：不急着重启；立即 dump memory，路径写入 Evidence（补丁 10）\n\n监控重点：\n□ 进程创建: CreateProcess \u002F ShellExecute\n□ 文件操作: WriteFile → 勒索? DeleteFile → Wiper?\n□ 注册表: Run\u002FRunOnce 持久化\n□ 网络: HTTP\u002FDNS → C2 通信\n□ 内存: VirtualAllocEx → 进程注入\n□ 服务: CreateService → 持久化\n□ IAT 修复失败 \u002F 自校验闪退样本：敏感 API + CreateFile\u002FGetFileSize 断点 \u002F 硬件执行断点 \u002F 内存搜索\n\n无行为应急分支（MUST）：\n□ 沙箱无行为、秒退或无限休眠 → 检查反调试\u002F反虚拟机（CPUID、计时、环境特征）\n□ 尝试硬件断点绕过、补丁检测点、或换物理机\u002F更高保真环境\n□ 将「无行为 + 条件」写入 Evidence；禁止无条件写成「样本无害」\n\n时间盒（补丁 9 · SHOULD 默认，可覆盖）：\n□ 静态深挖约 15 分钟无关键路径 → 强制转入本 Phase 动态\n□ 动态单步约 200 条指令无恶意线索 → 强制回静态字符串\u002F交叉引用重锚\n\n反调试\u002F混淆旁路（Issue #65 A–T · 详见 reverse-engineering\u002Fanti-analysis.md 菜谱）：\n□ P0：CPUID \u002F RDTSC \u002F PEB \u002F NtQueryInformationProcess → 记录检测点后 lab 绕过或换环境（E-anti-debug-*）\n□ P0：干净 IAT → API 哈希动态解析（bp GetProcAddress，E-api-hash）\n□ P0：strings 空 → 串解密例程 + 宽字符串 UTF-16（E-string-decrypt \u002F E-wide-strings）\n□ P0：可疑签名 → SigCheck；无效\u002F吊销不降威胁（E-sig-forge）\n□ P1：进程名扫描 \u002F VEH \u002F int3·DR \u002F 重叠节 \u002F Overlay \u002F .rsrc \u002F Delay-Load\n□ H\u002FS 平坦化与不透明谓词 → ollvm-deobfuscation.md（不在此复制长文）\n□ 绕过失败也写 Evidence；禁止反调试退出 = 样本无害\n\n非 PE \u002F 脚本 \u002F DLL 补洞（Issue #65 U–AV · 详见 reverse-engineering\u002Freferences\u002Fnonpe-format-cookbook.md）：\n□ bat\u002Fcmd：SET 拼接还原（U）→ E-batch-deobf；UTF-16 BOM（V）；REM\u002FGOTO 淹没（W）\n□ PowerShell：多层 Base64\u002FGzip（X）逐层 Evidence；IEX 拼接\u002F反转（Z）  # security-allowlist: SEC005\n□ VBA：Stomping\u002FP-Code（AA）；Chr\u002FBase64（AB）；自修改宏（AC）\n□ DLL：TLS+DllMain（AJ）；导出异常\u002F无导出（AK\u002FAL）；Delay-Load 见 A–T R（AM）；侧加载\u002F反射（AO\u002FAP）\n□ JS\u002FAPK\u002F驱动：路由 js-reverse \u002F apk-reverse \u002F kernel-driver-reverse + cookbook，不在此复制长文\n```\n\n### Phase 4: YARA 规则编写\n\n```yara\n\u002F\u002F 规则结构\nrule MalwareFamily_Example {\n    meta:\n        description = \"检测 Example 恶意软件家族\"\n        author = \"分析者\"\n        date = \"2026-05\"\n        severity = \"high\"\n        hash = \"d41d8cd98f00b204e9800998ecf8427e\"\n        mitre_id = \"T1055\"  \u002F\u002F Process Injection\n\n    strings:\n        \u002F\u002F 字符串匹配\n        $str1 = \"C2_SERVER_URL\" ascii wide\n        $str2 = \"payload.dat\" ascii\n\n        \u002F\u002F 十六进制匹配\n        $hex1 = { 8B 45 ?? 50 FF 15 [4] 85 C0 }\n        \u002F\u002F 操作码序列: mov eax, [ebp-?]; push eax; call [import]; test eax, eax\n\n        \u002F\u002F 正则匹配\n        $re1 = \u002Fhttps?:\\\u002F\\\u002F[a-z0-9.-]+\\\u002F[a-z]{3,8}\\.php\u002F ascii\n\n    condition:\n        \u002F\u002F 组合条件\n        uint16(0) == 0x5A4D and     \u002F\u002F MZ 头\n        filesize \u003C 500KB and\n        (2 of ($str*) or $hex1)\n}\n```\n\n### Phase 5: Sigma 规则生成\n\n```yaml\n# 行为检测规则\ntitle: Suspicious Process Injection via CreateRemoteThread\nid: 5a3d2c1b-1234-5678-9abc-def012345678\nstatus: experimental\ndescription: 检测使用 CreateRemoteThread 的进程注入行为\nauthor: 分析者\ndate: 2026\u002F05\u002F25\ntags:\n    - attack.t1055          # Process Injection\n    - attack.t1055.001      # DLL Injection\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - 'CreateRemoteThread'\n            - 'VirtualAllocEx'\n            - 'WriteProcessMemory'\n    condition: selection\nfalsepositives:\n    - 合法的调试工具\nlevel: high\n```\n\n### Phase 6: IOC 提取与情报\n\n```text\nIOC 类型分类：\n□ 网络 IOC:\n  - IP: C2 地址（注意时效性）\n  - Domain: DGA 算法生成的域名（rsnkfda.com, xpqmje.net）\n  - URL: Payload 托管地址\n  - User-Agent: 自定义 UA 字符串\n\n□ 主机 IOC:\n  - 文件路径: %APPDATA%\\Microsoft\\Crypto\\RSA\\*.dat\n  - 注册表: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\n  - Mutex: Global\\{GUID} 互斥体名称\n  - 服务名: 伪装成系统服务的名称\n\n□ 行为 IOC:\n  - MITRE ATT&CK 技术 ID (T1055, T1003, T1571...)\n  - Sigma 规则 → SIEM 集成\n  - YARA 规则 → 端点检测\n\n□ 静态 IOC:\n  - 编译时间戳（可伪造）\n  - PDB 路径（含开发者信息）\n  - 节名异常（非标准 .text\u002F.data）\n  - 导入表异常组合（如勒索软件 CryptEncrypt + DeleteShadowCopies）\n```\n\n## 反分析技术速查\n\n| 技术 | 检测方法 | YARA 特征 |\n|------|---------|----------|\n| 虚拟机检测 | WMI Win32_BIOS\u002FVideoController\u002FProcessor | `Win32_` 字符串 + 特定厂商名 |\n| 沙箱检测 | 磁盘 \u003C 60GB, RAM \u003C 2GB, 单核 CPU | GlobalMemoryStatusEx 调用模式 |\n| 调试器检测 | IsDebuggerPresent, CheckRemoteDebuggerPresent | PEB.BeingDebugged 偏移访问 |\n| 定时逃逸 | Sleep(300000) 后执行恶意行为 | NtDelayExecution 长参数 |\n| 地理位置检测 | 检查键盘布局\u002F时区 → 排除 CIS 国家 | GetKeyboardLayoutList 调用 |\n| 父进程检测 | explorer.exe vs cmd.exe | 进程名字符串比较 |\n| API 直接 syscall | 绕过 EDR hook | syscall 指令 + SSN 解析 |\n\n## 多 Agent 自动化分析 (SentinelHive 架构)\n\n```text\n┌─────────────────────────────────────────────────┐\n│                  Hive Director                    │\n│          (Claude Opus 编排 + 仲裁)                │\n└──────┬──────┬──────┬──────┬──────┬───────┘\n       │      │      │      │      │\n   ┌───┘  ┌───┘  ┌───┘  ┌───┘  ┌───┘\n   ▼      ▼      ▼      ▼      ▼      ▼\nTriage  RE    Behav  Intel  Detect Remed\n 快速   反编译  行为   威胁   规则   修复\n 分诊   静态   动态   情报   YARA  方案\n                          Sigma\n```\n\n## 工具链\n\n| 工具 | 用途 | 获取 |\n|------|------|------|\n| Ghidra \u002F IDA Pro | 深度反编译 | ghidra-sre.org |\n| CAPE Sandbox | 开源恶意软件沙箱 | GitHub: kevoreilly\u002FCAPEv2 |\n| ASD Azul | 大规模自动化分析 | GitHub: ASD |\n| YARA | 模式匹配规则引擎 | `pip install yara-python` |\n| Sigma | SIEM 行为检测规则 | GitHub: SigmaHQ\u002Fsigma |\n| FLOSS | 去混淆字符串提取 | `pip install flare-floss` |\n| Detect It Easy | 壳\u002F编译器检测 | GitHub: horsicq\u002FDetect-It-Easy |\n| pe-sieve | 进程内存扫描 | GitHub: hasherezade\u002Fpe-sieve |\n| VirusTotal API | 多引擎扫描 | virustotal.com |\n| MalwareBazaar | 恶意软件样本库 | bazaar.abuse.ch |\n\n## 参考\n\n- `references\u002Fyara-sigma-rules.md` — YARA + Sigma 编写方法论\n- `references\u002Fsandbox-orchestration.md` — 沙箱编排与自动化\n- `references\u002Fanti-analysis-techniques.md` — 94 种反分析技术检测\n- `..\u002Freverse-engineering\u002Freferences\u002Fre-agent-workflow.md` — IAT 铁律与六阶段门闩（Issue #65）\n- `..\u002Freverse-engineering\u002Fanti-analysis.md` — Agent 响应菜谱 A–T（反调试\u002F混淆旁路）\n- `..\u002Freverse-engineering\u002Freferences\u002Fnonpe-format-cookbook.md` — 非 PE\u002F多格式菜谱 U–AV（脚本\u002F宏\u002FJS\u002F驱动\u002FDLL\u002FAndroid）\n- `..\u002Freverse-engineering\u002Freferences\u002Follvm-deobfuscation.md` — 平坦化\u002F不透明谓词（H\u002FS）\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 导入表 MUST 检查是否已执行并写入 Evidence（E-imports 或 .NET 等价锚点）？DLL\u002FSYS 是否含 E-exports？\n- [ ] 若 IAT 修复失败或自校验闪退：是否记录 E-iat-repair-fail \u002F E-self-check-crash 并转入动态？\n- [ ] 重做请求是否回到被点名步骤或经确认的前提协商？阻塞时是否说明+请确认而非偷换步骤？\n- [ ] 动态是否按 TLS→EP→敏感 API→ExitProcess 保底顺序预置断点？时间盒\u002F高危 API 组合是否按旁路处理？\n- [ ] 反调试\u002F混淆（A–T）是否按 anti-analysis 菜谱记录 Evidence？签名无效是否未错误降级威胁？\n- [ ] 脚本\u002F宏\u002FDLL 等非 PE 类型是否按 U–AV cookbook 记录对应 Evidence（如 E-batch-deobf \u002F E-ps-decode \u002F E-vba-pcode \u002F E-dll-*）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Never detonate live samples outside isolated, disposable VMs.\n- Anti-VM techniques can stall or mislead automated sandboxes.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n",{"name":5,"risk":30,"source":43,"license":14,"date_added":44,"description":7,"source_repo":45,"source_type":27,"license_source":46},"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill","2026-08-25","zhaoxuya520\u002Freverse-skill","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fmalware-analysis","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill malware-analysis",{"tool":58,"command":59},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill malware-analysis",{"tool":61,"command":62},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill malware-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmalware-analysis\u002FSKILL.md",true,[66,72,76],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fanti-analysis-techniques.md","REFERENCE","参考文档",5698,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmalware-analysis\u002Freferences\u002Fanti-analysis-techniques.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fsandbox-orchestration.md",5239,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmalware-analysis\u002Freferences\u002Fsandbox-orchestration.md",{"path":77,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fyara-sigma-rules.md",6494,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmalware-analysis\u002Freferences\u002Fyara-sigma-rules.md",[81,110,133,154,182,206],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":92,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[87],{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[93,94,95,96,97,98,83,99,100,101,102,103,27,26,104,105,106,107,108,109],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[117,118,119,120,121,35,122,123,124,125,126,127,128,103,129,27,130,131,105,132],"delegate","zcode","zcode delegate","review","cli","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[140,141,142,30,37,143,144,34,33,145,146,147,148,27,26,149,150,151,152,153],"transcript","youtube transcript","youtube","codex","research","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":171,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[160,163,166],{"categoryNo":161,"categoryName":162,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":164,"categoryName":165,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":167,"categoryName":168,"taxonomyType":169,"taxonomyTypeDesc":170},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[140,141,142,172,30,173,37,143,34,174,175,176,177,146,178,27,26,179,180,181],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":192,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":164,"categoryName":165,"taxonomyType":90,"taxonomyTypeDesc":91},[142,193,194,121,30,195,196,197,198,34,176,199,200,201,202,26,203,149,204,205],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[212],{"categoryNo":161,"categoryName":162,"taxonomyType":90,"taxonomyTypeDesc":91},[214,142,215,216,30,173,174,217,218,175,176,177,146,219,178,27,26,179,220,152],"youtube full","full","google","server","dlp","credits","automatic"]