[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DBHMBTAG302W715TM5CN0R":3,"skill-same:01M6DBHMBTAG302W715TM5CN0R":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":14,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":43,"install":44,"resources":57},"01M6DBHMBTAG302W715TM5CN0R","malware-analysis-triage",null,"Use when triaging a suspicious PE, ELF, .NET binary, or shellcode for authorized malware analysis, defensive detection engineering, CTF, or reverse engineering.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmalware-analysis-triage\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"triage","malware analysis","malware","analysis","malware analysis triage","suspicious","engineering","ELF","detection","use","shellcode","ctf","binary","detection engineering","2026-11-10 10:12:30",false,"---\nname: malware-analysis-triage\ndescription: \"Use when triaging a suspicious PE, ELF, .NET binary, or shellcode for authorized malware analysis, defensive detection engineering, CTF, or reverse engineering.\"\n---\n\n# Malware Analysis Triage (capa \u002F FLOSS \u002F ghidriff)\n\n## Overview\n\nThree FLARE\u002FMandiant defensive CLIs that turn an unknown blob into actionable\nintelligence in seconds, before you sink hours into IDA\u002FGhidra:\n\n- **capa** — *what can this binary do?* Static capability detection mapped to\n  MITRE ATT&CK and MBC (persistence, C2, injection, anti-analysis, crypto).\n- **FLOSS** — *what is it hiding?* Recovers stack \u002F tight \u002F decoded strings that\n  plain `strings` cannot see (C2 URLs, keys, mutexes, config).\n- **ghidriff** — *what changed?* Headless Ghidra binary diff between two builds,\n  rendered as shareable markdown — for n-day \u002F Patch-Tuesday research and\n  variant hunting.\n\n**Framing:** This is defensive triage and authorized RE. Use it on samples you\nare authorized to analyze (your own, quarantined, sandbox-detonated, CTF, or\nvendor patches). Every capability you find should feed a *detection*, not an\nattack — see the Defensive Pairing column below.\n\n## When to Use\n\n- You have an unknown\u002Fsuspicious executable and need a fast behavior summary.\n- `strings` returned nothing useful but the sample is clearly doing something.\n- You need MITRE ATT&CK technique IDs to write or validate Sigma\u002FEDR\u002FYARA rules.\n- You want to know exactly which functions to reverse first (jump to addresses).\n- A vendor shipped a patch and you need to find the fixed code path (n-day).\n\n**When NOT to use:** dynamic\u002Fsandbox detonation (use CAPE\u002FDRAKVUF\u002FVMRay, then\nfeed their JSON to capa); live debugging (use `$reverse-engineering-toolkit`);\ndeep manual decompilation (these tools point you there, they don't replace it).\n\n## Install (Windows, this workspace)\n\nPython 3.14 + pip are on PATH; Ghidra 12.0.3 is installed with\n`GHIDRA_INSTALL_DIR` already set (satisfies ghidriff's Ghidra 11.4+ need).\n\n```bash\npython -m pip install --user flare-capa flare-floss ghidriff\n```\n\nInstalled and verified in this workspace: **flare-capa 9.4.0**, **flare-floss\n3.1.1**, **ghidriff 1.0.0** (Python 3.14).\n\n**Invocation gotcha (load-bearing):** `pip install --user` puts the console\nscripts in `C:\\Users\\Prekzursil\\AppData\\Roaming\\Python\\Python314\\Scripts`, which\nis **not on PATH** — so a bare `capa` \u002F `floss` \u002F `ghidriff` will not resolve.\nUse the PATH-independent module form (verified working):\n\n```bash\npython -m capa.main --version    # capa 9.4.0  (NOTE: capa.main, not -m capa)\npython -m floss --version        # FLOSS 3.1.1\npython -m ghidriff --version     # ghidriff 1.0.0\necho \"$GHIDRA_INSTALL_DIR\"        # D:\\Program Files\\Ghidra\\ghidra_12.0.3_PUBLIC\n```\n\nAlternatively add that Scripts dir to PATH (or call the `.exe` files there\ndirectly) to use the bare `capa` \u002F `floss` \u002F `ghidriff` commands shown in the\nQuick Reference below.\n\n**capa needs rules + signatures (load-bearing — pip does NOT bundle them).** The\n`flare-capa` wheel ships *no* rules or FLIRT signatures, so a bare\n`capa sample.exe` fails with `default embedded rules not found! (maybe you\ninstalled capa as a library?)` and then `default signature path ... doesn't\nexist`. Both are already fetched in this workspace (matching v9.4.0):\n\n```\nrules: C:\\Users\\Prekzursil\\.local\\share\\capa\\capa-rules-9.4.0\nsigs:  C:\\Users\\Prekzursil\\.local\\share\\capa\\sigs\n```\n\nSo every capa run must pass `-r` and `-s` (verified working):\n\n```bash\npython -m capa.main -r ~\u002F.local\u002Fshare\u002Fcapa\u002Fcapa-rules-9.4.0 -s ~\u002F.local\u002Fshare\u002Fcapa\u002Fsigs sample.exe\n```\n\nTo re-provision after a capa upgrade, re-download the matching tag:\n`capa-rules` from `github.com\u002Fmandiant\u002Fcapa-rules\u002Farchive\u002Frefs\u002Ftags\u002FvX.Y.Z.zip`\nand the `sigs\u002F` folder from the capa source tarball\n`github.com\u002Fmandiant\u002Fcapa\u002Farchive\u002Frefs\u002Ftags\u002FvX.Y.Z.zip`. The **standalone capa\nbinary** bundles both rules and sigs, so it sidesteps this entirely — prefer it\ninside an analysis VM.\n\nStandalone-binary alternative (no Python deps, good for an isolated analysis VM):\ndownload the release binaries for capa and FLOSS from their GitHub releases and\ndrop them on PATH. Prefer the standalone build inside the malware VM so you are\nnot adding the sample's dependencies to your Python env.\n\n`capa` ships its own pinned rule set; refresh periodically with\n`capa --version` and pulling the latest `flare-capa`. For a separate rules\ncheckout use `capa -r \u003Crules-dir>`.\n\n## Quick Reference\n\ncapa needs `-r RULES -s SIGS` (see Install). Shorthand below: set\n`R=~\u002F.local\u002Fshare\u002Fcapa\u002Fcapa-rules-9.4.0 S=~\u002F.local\u002Fshare\u002Fcapa\u002Fsigs` and use\n`python -m capa.main -r \"$R\" -s \"$S\" ...`.\n\n| Goal | Command |\n|------|---------|\n| Capability + ATT&CK report | `python -m capa.main -r \"$R\" -s \"$S\" sample.exe` |\n| Same, with exact addresses per capability | `... -r \"$R\" -s \"$S\" -vv sample.exe` |\n| JSON for tooling \u002F pipelines | `... -r \"$R\" -s \"$S\" -j sample.exe > caps.json` |\n| Ingest a sandbox report (beats packing) | `... -r \"$R\" -s \"$S\" cape_report.json` |\n| All hidden strings | `floss sample.exe` |\n| Only stack + tight strings | `floss --only stack tight -- sample.exe` |\n| Skip slow decoded-string emulation | `floss --no decoded -- sample.exe` |\n| Plain static strings only (fast) | `floss --only static -- sample.exe` |\n| Diff two builds to markdown | `ghidriff old.bin new.bin` |\n| Side-by-side HTML diff | `ghidriff --sxs old.bin new.bin` |\n| Cap RAM on a large binary | `ghidriff --max-ram-percent 50 old.bin new.bin` |\n\nRun capa and FLOSS together on **every** sample — they are complementary and\nboth cheap.\n\n## Defensive Pairing (turn findings into detections)\n\n| Tool finding | Defensive action |\n|--------------|------------------|\n| capa ATT&CK ID, e.g. T1053 \"scheduled task\" | Confirm you alert on `schtasks`\u002FTask Scheduler events; write\u002Fvalidate a Sigma rule for that technique. |\n| capa \"process injection\" \u002F \"C2 over HTTP\" | Seed an EDR hunt hypothesis; map to existing analytics coverage. |\n| FLOSS-recovered C2 URL \u002F key \u002F mutex | Add IOC to blocklist\u002Ffeed; build a YARA rule on the constant or decoded string. |\n| ghidriff patched-function delta | Write detection for the *pre-patch* exploitation primitive before exploits ship. |\n\nThe whole point: capa's technique IDs are the *same* IDs you feed to Sigma\u002FEDR,\nso triage output drives detection engineering directly.\n\n## Gotchas\n\n- **capa** static backend is defeated by heavy packing\u002Fobfuscation — pivot to\n  the sandbox-report mode (`capa report.json`) or unpack first. Rule set is\n  version-pinned to the installed `flare-capa`.\n- **FLOSS** decoded-string recovery emulates decoder functions and has a time\n  budget; very large\u002Fpacked binaries may need `--no decoded`. It is NOT a\n  sandbox — no network\u002FIO is performed.\n- **ghidriff** diff quality depends on Ghidra auto-analysis completing; large\n  binaries are RAM-hungry (tune `--max-ram-percent`). First run is slow because\n  Ghidra analyzes both binaries. For IDA-bound, microcode-level CVE\n  localization or symbol porting, escalate to **Diaphora** (AGPL, IDA plugin).\n- Always analyze samples in an **isolated VM** with no host shares mounted. capa\n  and FLOSS do not execute the sample, but you will be handling live malware\n  on disk.\n\n## Workflow\n\n1. `python -m capa.main -r \"$R\" -s \"$S\" -vv sample.exe` — read the capability +\n   ATT&CK summary; note addresses of the highest-value capabilities (injection,\n   C2, persistence, crypto).\n2. `python -m floss sample.exe` — pull config\u002FIOCs; record C2, keys, mutexes.\n3. Open the sample in IDA\u002FGhidra\u002FBN (`$reverse-engineering-toolkit`,\n   `$re-ensure`) and jump straight to the capa addresses instead of reading the\n   whole binary.\n4. If you have an old + new build (patch research): `ghidriff old new` and read\n   the markdown for the changed functions.\n5. Turn every finding into a detection (Defensive Pairing table) — `$semgrep`,\n   `$code-security`, Sigma, or YARA.\n\n## Related\n\n- `references\u002Fcommands.md` — fuller command reference and CI\u002Fheadless notes.\n- `$reverse-engineering-toolkit` — choosing the next tool after triage.\n- `$re-ensure`, `$ghidra-mcp`, `$ida-pro-mcp` — bring up disassembler backends.\n- security-kb `gems-seclis.md` §1-2 — source decision-queue for these gems.\n","# Malware Analysis Triage (capa \u002F FLOSS \u002F ghidriff)\n\n## Overview\n\nThree FLARE\u002FMandiant defensive CLIs that turn an unknown blob into actionable\nintelligence in seconds, before you sink hours into IDA\u002FGhidra:\n\n- **capa** — *what can this binary do?* Static capability detection mapped to\n  MITRE ATT&CK and MBC (persistence, C2, injection, anti-analysis, crypto).\n- **FLOSS** — *what is it hiding?* Recovers stack \u002F tight \u002F decoded strings that\n  plain `strings` cannot see (C2 URLs, keys, mutexes, config).\n- **ghidriff** — *what changed?* Headless Ghidra binary diff between two builds,\n  rendered as shareable markdown — for n-day \u002F Patch-Tuesday research and\n  variant hunting.\n\n**Framing:** This is defensive triage and authorized RE. Use it on samples you\nare authorized to analyze (your own, quarantined, sandbox-detonated, CTF, or\nvendor patches). Every capability you find should feed a *detection*, not an\nattack — see the Defensive Pairing column below.\n\n## When to Use\n\n- You have an unknown\u002Fsuspicious executable and need a fast behavior summary.\n- `strings` returned nothing useful but the sample is clearly doing something.\n- You need MITRE ATT&CK technique IDs to write or validate Sigma\u002FEDR\u002FYARA rules.\n- You want to know exactly which functions to reverse first (jump to addresses).\n- A vendor shipped a patch and you need to find the fixed code path (n-day).\n\n**When NOT to use:** dynamic\u002Fsandbox detonation (use CAPE\u002FDRAKVUF\u002FVMRay, then\nfeed their JSON to capa); live debugging (use `$reverse-engineering-toolkit`);\ndeep manual decompilation (these tools point you there, they don't replace it).\n\n## Install (Windows, this workspace)\n\nPython 3.14 + pip are on PATH; Ghidra 12.0.3 is installed with\n`GHIDRA_INSTALL_DIR` already set (satisfies ghidriff's Ghidra 11.4+ need).\n\n```bash\npython -m pip install --user flare-capa flare-floss ghidriff\n```\n\nInstalled and verified in this workspace: **flare-capa 9.4.0**, **flare-floss\n3.1.1**, **ghidriff 1.0.0** (Python 3.14).\n\n**Invocation gotcha (load-bearing):** `pip install --user` puts the console\nscripts in `C:\\Users\\Prekzursil\\AppData\\Roaming\\Python\\Python314\\Scripts`, which\nis **not on PATH** — so a bare `capa` \u002F `floss` \u002F `ghidriff` will not resolve.\nUse the PATH-independent module form (verified working):\n\n```bash\npython -m capa.main --version    # capa 9.4.0  (NOTE: capa.main, not -m capa)\npython -m floss --version        # FLOSS 3.1.1\npython -m ghidriff --version     # ghidriff 1.0.0\necho \"$GHIDRA_INSTALL_DIR\"        # D:\\Program Files\\Ghidra\\ghidra_12.0.3_PUBLIC\n```\n\nAlternatively add that Scripts dir to PATH (or call the `.exe` files there\ndirectly) to use the bare `capa` \u002F `floss` \u002F `ghidriff` commands shown in the\nQuick Reference below.\n\n**capa needs rules + signatures (load-bearing — pip does NOT bundle them).** The\n`flare-capa` wheel ships *no* rules or FLIRT signatures, so a bare\n`capa sample.exe` fails with `default embedded rules not found! (maybe you\ninstalled capa as a library?)` and then `default signature path ... doesn't\nexist`. Both are already fetched in this workspace (matching v9.4.0):\n\n```\nrules: C:\\Users\\Prekzursil\\.local\\share\\capa\\capa-rules-9.4.0\nsigs:  C:\\Users\\Prekzursil\\.local\\share\\capa\\sigs\n```\n\nSo every capa run must pass `-r` and `-s` (verified working):\n\n```bash\npython -m capa.main -r ~\u002F.local\u002Fshare\u002Fcapa\u002Fcapa-rules-9.4.0 -s ~\u002F.local\u002Fshare\u002Fcapa\u002Fsigs sample.exe\n```\n\nTo re-provision after a capa upgrade, re-download the matching tag:\n`capa-rules` from `github.com\u002Fmandiant\u002Fcapa-rules\u002Farchive\u002Frefs\u002Ftags\u002FvX.Y.Z.zip`\nand the `sigs\u002F` folder from the capa source tarball\n`github.com\u002Fmandiant\u002Fcapa\u002Farchive\u002Frefs\u002Ftags\u002FvX.Y.Z.zip`. The **standalone capa\nbinary** bundles both rules and sigs, so it sidesteps this entirely — prefer it\ninside an analysis VM.\n\nStandalone-binary alternative (no Python deps, good for an isolated analysis VM):\ndownload the release binaries for capa and FLOSS from their GitHub releases and\ndrop them on PATH. Prefer the standalone build inside the malware VM so you are\nnot adding the sample's dependencies to your Python env.\n\n`capa` ships its own pinned rule set; refresh periodically with\n`capa --version` and pulling the latest `flare-capa`. For a separate rules\ncheckout use `capa -r \u003Crules-dir>`.\n\n## Quick Reference\n\ncapa needs `-r RULES -s SIGS` (see Install). Shorthand below: set\n`R=~\u002F.local\u002Fshare\u002Fcapa\u002Fcapa-rules-9.4.0 S=~\u002F.local\u002Fshare\u002Fcapa\u002Fsigs` and use\n`python -m capa.main -r \"$R\" -s \"$S\" ...`.\n\n| Goal | Command |\n|------|---------|\n| Capability + ATT&CK report | `python -m capa.main -r \"$R\" -s \"$S\" sample.exe` |\n| Same, with exact addresses per capability | `... -r \"$R\" -s \"$S\" -vv sample.exe` |\n| JSON for tooling \u002F pipelines | `... -r \"$R\" -s \"$S\" -j sample.exe > caps.json` |\n| Ingest a sandbox report (beats packing) | `... -r \"$R\" -s \"$S\" cape_report.json` |\n| All hidden strings | `floss sample.exe` |\n| Only stack + tight strings | `floss --only stack tight -- sample.exe` |\n| Skip slow decoded-string emulation | `floss --no decoded -- sample.exe` |\n| Plain static strings only (fast) | `floss --only static -- sample.exe` |\n| Diff two builds to markdown | `ghidriff old.bin new.bin` |\n| Side-by-side HTML diff | `ghidriff --sxs old.bin new.bin` |\n| Cap RAM on a large binary | `ghidriff --max-ram-percent 50 old.bin new.bin` |\n\nRun capa and FLOSS together on **every** sample — they are complementary and\nboth cheap.\n\n## Defensive Pairing (turn findings into detections)\n\n| Tool finding | Defensive action |\n|--------------|------------------|\n| capa ATT&CK ID, e.g. T1053 \"scheduled task\" | Confirm you alert on `schtasks`\u002FTask Scheduler events; write\u002Fvalidate a Sigma rule for that technique. |\n| capa \"process injection\" \u002F \"C2 over HTTP\" | Seed an EDR hunt hypothesis; map to existing analytics coverage. |\n| FLOSS-recovered C2 URL \u002F key \u002F mutex | Add IOC to blocklist\u002Ffeed; build a YARA rule on the constant or decoded string. |\n| ghidriff patched-function delta | Write detection for the *pre-patch* exploitation primitive before exploits ship. |\n\nThe whole point: capa's technique IDs are the *same* IDs you feed to Sigma\u002FEDR,\nso triage output drives detection engineering directly.\n\n## Gotchas\n\n- **capa** static backend is defeated by heavy packing\u002Fobfuscation — pivot to\n  the sandbox-report mode (`capa report.json`) or unpack first. Rule set is\n  version-pinned to the installed `flare-capa`.\n- **FLOSS** decoded-string recovery emulates decoder functions and has a time\n  budget; very large\u002Fpacked binaries may need `--no decoded`. It is NOT a\n  sandbox — no network\u002FIO is performed.\n- **ghidriff** diff quality depends on Ghidra auto-analysis completing; large\n  binaries are RAM-hungry (tune `--max-ram-percent`). First run is slow because\n  Ghidra analyzes both binaries. For IDA-bound, microcode-level CVE\n  localization or symbol porting, escalate to **Diaphora** (AGPL, IDA plugin).\n- Always analyze samples in an **isolated VM** with no host shares mounted. capa\n  and FLOSS do not execute the sample, but you will be handling live malware\n  on disk.\n\n## Workflow\n\n1. `python -m capa.main -r \"$R\" -s \"$S\" -vv sample.exe` — read the capability +\n   ATT&CK summary; note addresses of the highest-value capabilities (injection,\n   C2, persistence, crypto).\n2. `python -m floss sample.exe` — pull config\u002FIOCs; record C2, keys, mutexes.\n3. Open the sample in IDA\u002FGhidra\u002FBN (`$reverse-engineering-toolkit`,\n   `$re-ensure`) and jump straight to the capa addresses instead of reading the\n   whole binary.\n4. If you have an old + new build (patch research): `ghidriff old new` and read\n   the markdown for the changed functions.\n5. Turn every finding into a detection (Defensive Pairing table) — `$semgrep`,\n   `$code-security`, Sigma, or YARA.\n\n## Related\n\n- `references\u002Fcommands.md` — fuller command reference and CI\u002Fheadless notes.\n- `$reverse-engineering-toolkit` — choosing the next tool after triage.\n- `$re-ensure`, `$ghidra-mcp`, `$ida-pro-mcp` — bring up disassembler backends.\n- security-kb `gems-seclis.md` §1-2 — source decision-queue for these gems.\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Fmalware-analysis-triage","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage",{"tool":50,"command":51},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage",{"tool":53,"command":54},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmalware-analysis-triage\u002FSKILL.md",true,[58],{"path":59,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Fcommands.md","REFERENCE","参考文档",6094,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmalware-analysis-triage\u002Freferences\u002Fcommands.md",[65,86,117,144,158,174],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":33},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[72,73,74,75,76,77,78,79,80,28,81,82,83,84,85],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","context","repo","injection","execution","file",{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":97,"publishedAt":33},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[92],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[98,99,100,101,102,103,104,105,106,107,108,109,110,111,28,112,113,114,115,116],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":129,"publishedAt":33},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[123,126],{"categoryNo":124,"categoryName":125,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000008","测试与质量",[130,131,132,133,134,135,136,137,138,139,99,140,141,142,143],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":33},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[146,151,152,153,154,155,156,157],"setup","report","project","installation","project setup","issues","state",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":33},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[164],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},[160,166,77,167,168,169,28,170,171,172,173],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":175,"name":151,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":33},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[151,153,114,180,155,181],"files","interactive"]