Security & Testing Agent Skills for Claude Code

Query the Malpedia API to look up malware family aliases and naming

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Detect and analyze covert communication channels used by malware, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated…

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event…

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program…

Analyzes encryption algorithms, key management, and file encryption

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and…

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations.

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data…

Investigate supply chain attack artifacts including trojanized software

This skill analyzes code coverage metrics to identify untested code and generate comprehensive coverage reports.

Use to audit test quality with SRE scrutiny - identifies weak tests, missing cases, and creates task docs for improvements

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the…