Malware Analysis

---
name: malware-analysis
description: Defensive triage for suspicious files, scripts, or dependencies the user has already encountered (e.g. a suspicious npm package, an unexpected script in a repo, a file behaving oddly). Use only to identify and explain suspicious behavior in code the user already has, to help them decide whether to remove/report it — never to create, improve, or "test" malicious payloads.
---

# Malware Analysis — Defensive Triage for Suspicious Code

A **strictly defensive** skill: helping the user understand whether a file, script, or package already present in their project is malicious, and why, so they can remove it or report it.

## When to use this
- The user suspects an npm/pip/other package added to their project
- An unfamiliar script exists (a postinstall script, a cron job, oddly obfuscated code) with no clear explanation
- A file behaves unexpectedly (unexplained network calls, modifying system files)

## What This Skill Does
1. **Static triage.** Read the provided code and look for common indicators:
   - Network connections to domains/IPs unrelated to the package's stated purpose
   - Excessive obfuscation with no legitimate reason for a simple package
   - Reading sensitive environment variables (keys, tokens) and exfiltrating them
   - `postinstall`/`preinstall` scripts in `package.json` that execute extra code on install
   - Modification of system files or configuration unrelated to the tool's stated function
2. **Explain in plain language.** Describe what the suspicious code actually does, line by line where useful — without improving, "cleaning up," or making it more effective.
3. **Recommend next steps.** Should it be removed immediately? Should any secrets be rotated because they may have already leaked? Is it worth reporting (to npm/PyPI security, GitHub Security Advisories, etc.)?

## Report Format
```
File/Package: [name]
Suspicious Indicators: [list of indicators found]
What it does: [plain-language behavior description]
Risk Level: Critical/High/Medium/Low
Recommendation: [remove / rotate secrets / report / monitor]
```

## Hard, Non-Negotiable Limits
- This skill is for **analysis and understanding only** — never for writing, improving, or "fixing" malicious code to make it work better.
- Never produce an "educational" or "test" version of the malicious code itself.
- Never explain how to bypass antivirus or detection tooling.
- If a request looks like it's asking to build a new malicious tool (rather than analyze something that already exists), decline and redirect to the other defensive scanning skills instead.
- When intent is unclear, ask for clarification: is this an existing file that needs analysis, or a request to create new code?