Security & Testing Agent Skills for Claude Code

Perform static analysis of malicious PDF documents using peepdf, pdfid,

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Executes malware samples in Cuckoo Sandbox to observe runtime behavior

Detect sandbox evasion techniques in malware samples by analyzing timing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Detect and analyze covert communication channels used by malware including

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Craft, send, sniff, and dissect network packets using Scapy for protocol

Captures and analyzes network packet data using Wireshark and tshark

Analyze Microsoft Outlook PST and OST files for email forensic evidence

Identifies and unpacks UPX-packed and other packed malware samples to

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect and analyze Linux persistence mechanisms including crontab entries,

Detect PowerShell Empire framework artifacts in Windows event logs by

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Analyzes encryption algorithms, key management, and file encryption

Identify ransomware network indicators including C2 beaconing patterns,

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Analyzes structured and unstructured threat intelligence feeds to extract

Investigate USB device connection history from Windows registry, event