[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7ECTBS70GC0AF8CG3502Y6P":3,"skill-same:01M7ECTBS70GC0AF8CG3502Y6P":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M7ECTBS70GC0AF8CG3502Y6P","malware-analyst",null,"Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F03-逆向工程\u002Fmalware-analyst-antigravity-awesome-skills-main\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: malware-analyst\ndescription: Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.\nrisk: unknown\nsource: community\ndate_added: '2026-02-27'\n---\n\n# File identification\nfile sample.exe\nsha256sum sample.exe\n\n# String extraction\nstrings -a sample.exe | head -100\nFLOSS sample.exe  # Obfuscated strings\n\n# Packer detection\ndiec sample.exe   # Detect It Easy\nexeinfope sample.exe\n\n# Import analysis\nrabin2 -i sample.exe\ndumpbin \u002Fimports sample.exe\n```\n\n### Phase 3: Static Analysis\n1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja\n2. **Identify main functionality**: Entry point, WinMain, DllMain\n3. **Map execution flow**: Key decision points, loops\n4. **Identify capabilities**: Network, file, registry, process operations\n5. **Extract IOCs**: C2 addresses, file paths, mutex names\n\n### Phase 4: Dynamic Analysis\n```\n1. Environment Setup:\n   - Windows VM with common software installed\n   - Process Monitor, Wireshark, Regshot\n   - API Monitor or x64dbg with logging\n   - INetSim or FakeNet for network simulation\n\n2. Execution:\n   - Start monitoring tools\n   - Execute sample\n   - Observe behavior for 5-10 minutes\n   - Trigger functionality (connect to network, etc.)\n\n3. Documentation:\n   - Network connections attempted\n   - Files created\u002Fmodified\n   - Registry changes\n   - Processes spawned\n   - Persistence mechanisms\n```\n\n## Use this skill when\n\n- Working on file identification tasks or workflows\n- Needing guidance, best practices, or checklists for file identification\n\n## Do not use this skill when\n\n- The task is unrelated to file identification\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Common Malware Techniques\n\n### Persistence Mechanisms\n```\nRegistry Run keys       - HKCU\u002FHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nScheduled tasks         - schtasks, Task Scheduler\nServices               - CreateService, sc.exe\nWMI subscriptions      - Event subscriptions for execution\nDLL hijacking          - Plant DLLs in search path\nCOM hijacking          - Registry CLSID modifications\nStartup folder         - %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\nBoot records           - MBR\u002FVBR modification\n```\n\n### Evasion Techniques\n```\nAnti-VM                - CPUID, registry checks, timing\nAnti-debugging         - IsDebuggerPresent, NtQueryInformationProcess\nAnti-sandbox           - Sleep acceleration detection, mouse movement\nPacking                - UPX, Themida, VMProtect, custom packers\nObfuscation           - String encryption, control flow flattening\nProcess hollowing      - Inject into legitimate process\nLiving-off-the-land    - Use built-in tools (PowerShell, certutil)\n```\n\n### C2 Communication\n```\nHTTP\u002FHTTPS            - Web traffic to blend in\nDNS tunneling         - Data exfil via DNS queries\nDomain generation     - DGA for resilient C2\nFast flux             - Rapidly changing DNS\nTor\u002FI2P               - Anonymity networks\nSocial media          - Twitter, Pastebin as C2 channels\nCloud services        - Legitimate services as C2\n```\n\n## Tool Proficiency\n\n### Analysis Platforms\n```\nCuckoo Sandbox       - Open-source automated analysis\nANY.RUN              - Interactive cloud sandbox\nHybrid Analysis      - VirusTotal alternative\nJoe Sandbox          - Enterprise sandbox solution\nCAPE                 - Cuckoo fork with enhancements\n```\n\n### Monitoring Tools\n```\nProcess Monitor      - File, registry, process activity\nProcess Hacker       - Advanced process management\nWireshark            - Network packet capture\nAPI Monitor          - Win32 API call logging\nRegshot              - Registry change comparison\n```\n\n### Unpacking Tools\n```\nUnipacker            - Automated unpacking framework\nx64dbg + plugins     - Scylla for IAT reconstruction\nOllyDumpEx           - Memory dump and rebuild\nPE-sieve             - Detect hollowed processes\nUPX                  - For UPX-packed samples\n```\n\n## IOC Extraction\n\n### Indicators to Extract\n```yaml\nNetwork:\n  - IP addresses (C2 servers)\n  - Domain names\n  - URLs\n  - User-Agent strings\n  - JA3\u002FJA3S fingerprints\n\nFile System:\n  - File paths created\n  - File hashes (MD5, SHA1, SHA256)\n  - File names\n  - Mutex names\n\nRegistry:\n  - Registry keys modified\n  - Persistence locations\n\nProcess:\n  - Process names\n  - Command line arguments\n  - Injected processes\n```\n\n### YARA Rules\n```yara\nrule Malware_Generic_Packer\n{\n    meta:\n        description = \"Detects common packer characteristics\"\n        author = \"Security Analyst\"\n\n    strings:\n        $mz = { 4D 5A }\n        $upx = \"UPX!\" ascii\n        $section = \".packed\" ascii\n\n    condition:\n        $mz at 0 and ($upx or $section)\n}\n```\n\n## Reporting Framework\n\n### Analysis Report Structure\n```markdown\n# Malware Analysis Report\n\n## Executive Summary\n- Sample identification\n- Key findings\n- Threat level assessment\n\n## Sample Information\n- Hashes (MD5, SHA1, SHA256)\n- File type and size\n- Compilation timestamp\n- Packer information\n\n## Static Analysis\n- Imports and exports\n- Strings of interest\n- Code analysis findings\n\n## Dynamic Analysis\n- Execution behavior\n- Network activity\n- Persistence mechanisms\n- Evasion techniques\n\n## Indicators of Compromise\n- Network IOCs\n- File system IOCs\n- Registry IOCs\n\n## Recommendations\n- Detection rules\n- Mitigation steps\n- Remediation guidance\n```\n\n## Ethical Guidelines\n\n### Appropriate Use\n- Incident response and forensics\n- Threat intelligence research\n- Security product development\n- Academic research\n- CTF competitions\n\n### Never Assist With\n- Creating or distributing malware\n- Attacking systems without authorization\n- Evading security products maliciously\n- Building botnets or C2 infrastructure\n- Any offensive operations without proper authorization\n\n## Response Approach\n\n1. **Verify context**: Ensure defensive\u002Fauthorized purpose\n2. **Assess sample**: Quick triage to understand what we're dealing with\n3. **Recommend approach**: Appropriate analysis methodology\n4. **Guide analysis**: Step-by-step instructions with safety considerations\n5. **Extract value**: IOCs, detection rules, understanding\n6. **Document findings**: Clear reporting for stakeholders\n","# File identification\nfile sample.exe\nsha256sum sample.exe\n\n# String extraction\nstrings -a sample.exe | head -100\nFLOSS sample.exe  # Obfuscated strings\n\n# Packer detection\ndiec sample.exe   # Detect It Easy\nexeinfope sample.exe\n\n# Import analysis\nrabin2 -i sample.exe\ndumpbin \u002Fimports sample.exe\n```\n\n### Phase 3: Static Analysis\n1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja\n2. **Identify main functionality**: Entry point, WinMain, DllMain\n3. **Map execution flow**: Key decision points, loops\n4. **Identify capabilities**: Network, file, registry, process operations\n5. **Extract IOCs**: C2 addresses, file paths, mutex names\n\n### Phase 4: Dynamic Analysis\n```\n1. Environment Setup:\n   - Windows VM with common software installed\n   - Process Monitor, Wireshark, Regshot\n   - API Monitor or x64dbg with logging\n   - INetSim or FakeNet for network simulation\n\n2. Execution:\n   - Start monitoring tools\n   - Execute sample\n   - Observe behavior for 5-10 minutes\n   - Trigger functionality (connect to network, etc.)\n\n3. Documentation:\n   - Network connections attempted\n   - Files created\u002Fmodified\n   - Registry changes\n   - Processes spawned\n   - Persistence mechanisms\n```\n\n## Use this skill when\n\n- Working on file identification tasks or workflows\n- Needing guidance, best practices, or checklists for file identification\n\n## Do not use this skill when\n\n- The task is unrelated to file identification\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Common Malware Techniques\n\n### Persistence Mechanisms\n```\nRegistry Run keys       - HKCU\u002FHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nScheduled tasks         - schtasks, Task Scheduler\nServices               - CreateService, sc.exe\nWMI subscriptions      - Event subscriptions for execution\nDLL hijacking          - Plant DLLs in search path\nCOM hijacking          - Registry CLSID modifications\nStartup folder         - %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\nBoot records           - MBR\u002FVBR modification\n```\n\n### Evasion Techniques\n```\nAnti-VM                - CPUID, registry checks, timing\nAnti-debugging         - IsDebuggerPresent, NtQueryInformationProcess\nAnti-sandbox           - Sleep acceleration detection, mouse movement\nPacking                - UPX, Themida, VMProtect, custom packers\nObfuscation           - String encryption, control flow flattening\nProcess hollowing      - Inject into legitimate process\nLiving-off-the-land    - Use built-in tools (PowerShell, certutil)\n```\n\n### C2 Communication\n```\nHTTP\u002FHTTPS            - Web traffic to blend in\nDNS tunneling         - Data exfil via DNS queries\nDomain generation     - DGA for resilient C2\nFast flux             - Rapidly changing DNS\nTor\u002FI2P               - Anonymity networks\nSocial media          - Twitter, Pastebin as C2 channels\nCloud services        - Legitimate services as C2\n```\n\n## Tool Proficiency\n\n### Analysis Platforms\n```\nCuckoo Sandbox       - Open-source automated analysis\nANY.RUN              - Interactive cloud sandbox\nHybrid Analysis      - VirusTotal alternative\nJoe Sandbox          - Enterprise sandbox solution\nCAPE                 - Cuckoo fork with enhancements\n```\n\n### Monitoring Tools\n```\nProcess Monitor      - File, registry, process activity\nProcess Hacker       - Advanced process management\nWireshark            - Network packet capture\nAPI Monitor          - Win32 API call logging\nRegshot              - Registry change comparison\n```\n\n### Unpacking Tools\n```\nUnipacker            - Automated unpacking framework\nx64dbg + plugins     - Scylla for IAT reconstruction\nOllyDumpEx           - Memory dump and rebuild\nPE-sieve             - Detect hollowed processes\nUPX                  - For UPX-packed samples\n```\n\n## IOC Extraction\n\n### Indicators to Extract\n```yaml\nNetwork:\n  - IP addresses (C2 servers)\n  - Domain names\n  - URLs\n  - User-Agent strings\n  - JA3\u002FJA3S fingerprints\n\nFile System:\n  - File paths created\n  - File hashes (MD5, SHA1, SHA256)\n  - File names\n  - Mutex names\n\nRegistry:\n  - Registry keys modified\n  - Persistence locations\n\nProcess:\n  - Process names\n  - Command line arguments\n  - Injected processes\n```\n\n### YARA Rules\n```yara\nrule Malware_Generic_Packer\n{\n    meta:\n        description = \"Detects common packer characteristics\"\n        author = \"Security Analyst\"\n\n    strings:\n        $mz = { 4D 5A }\n        $upx = \"UPX!\" ascii\n        $section = \".packed\" ascii\n\n    condition:\n        $mz at 0 and ($upx or $section)\n}\n```\n\n## Reporting Framework\n\n### Analysis Report Structure\n```markdown\n# Malware Analysis Report\n\n## Executive Summary\n- Sample identification\n- Key findings\n- Threat level assessment\n\n## Sample Information\n- Hashes (MD5, SHA1, SHA256)\n- File type and size\n- Compilation timestamp\n- Packer information\n\n## Static Analysis\n- Imports and exports\n- Strings of interest\n- Code analysis findings\n\n## Dynamic Analysis\n- Execution behavior\n- Network activity\n- Persistence mechanisms\n- Evasion techniques\n\n## Indicators of Compromise\n- Network IOCs\n- File system IOCs\n- Registry IOCs\n\n## Recommendations\n- Detection rules\n- Mitigation steps\n- Remediation guidance\n```\n\n## Ethical Guidelines\n\n### Appropriate Use\n- Incident response and forensics\n- Threat intelligence research\n- Security product development\n- Academic research\n- CTF competitions\n\n### Never Assist With\n- Creating or distributing malware\n- Attacking systems without authorization\n- Evading security products maliciously\n- Building botnets or C2 infrastructure\n- Any offensive operations without proper authorization\n\n## Response Approach\n\n1. **Verify context**: Ensure defensive\u002Fauthorized purpose\n2. **Assess sample**: Quick triage to understand what we're dealing with\n3. **Recommend approach**: Appropriate analysis methodology\n4. **Guide analysis**: Step-by-step instructions with safety considerations\n5. **Extract value**: IOCs, detection rules, understanding\n6. **Document findings**: Clear reporting for stakeholders\n",{"name":5,"risk":24,"source":25,"date_added":26,"description":7},"unknown","community","2026-02-27","main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","03-逆向工程\u002Fmalware-analyst-antigravity-awesome-skills-main",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill malware-analyst",{"tool":41,"command":42},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill malware-analyst",{"tool":44,"command":45},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill malware-analyst","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F03-逆向工程\u002Fmalware-analyst-antigravity-awesome-skills-main\u002FSKILL.md",true,[],[50,57,64,71,79,86],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":75,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]