Agent skills for Codex CLI

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

Detect kernel-level rootkits in Linux memory dumps using Volatility3

Examine Linux system artifacts (auth logs, cron/systemd persistence,

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

Analyzes malicious VBA macros embedded in Microsoft Office documents

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

Query the Malpedia API to look up malware family aliases and naming

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Detect sandbox and VM evasion techniques in malware samples by analyzing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous…

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Calculate NFT rarity scores and rank tokens by trait uniqueness.

Process perform on-chain analysis including whale tracking, token flows,