[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DCQ9WE7C81CPVAN891HJMA":3,"skill-same:01M6DCQ9WE7C81CPVAN891HJMA":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":14,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":43,"install":44,"resources":57},"01M6DCQ9WE7C81CPVAN891HJMA","malware-analysis-triage",null,"Use when triaging a suspicious PE, ELF, .NET binary, or shellcode for authorized malware analysis, defensive detection engineering, CTF, or reverse engineering.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Fplatform\u002Frouting\u002Ffixtures\u002Fhome\u002F.agents\u002Fskills\u002Fmalware-analysis-triage\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"triage","malware analysis","malware","analysis","malware analysis triage","suspicious","engineering","ELF","detection","use","shellcode","ctf","binary","detection engineering","2026-11-10 10:12:30",false,"---\nname: malware-analysis-triage\ndescription: \"Use when triaging a suspicious PE, ELF, .NET binary, or shellcode for authorized malware analysis, defensive detection engineering, CTF, or reverse engineering.\"\n---\n\n# Malware Analysis Triage (capa \u002F FLOSS \u002F ghidriff)\n\n## Overview\n\nThree FLARE\u002FMandiant defensive CLIs that turn an unknown blob into actionable\nintelligence in seconds, before you sink hours into IDA\u002FGhidra:\n\n- **capa** — *what can this binary do?* Static capability detection mapped to\n  MITRE ATT&CK and MBC (persistence, C2, injection, anti-analysis, crypto).\n- **FLOSS** — *what is it hiding?* Recovers stack \u002F tight \u002F decoded strings that\n  plain `strings` cannot see (C2 URLs, keys, mutexes, config).\n- **ghidriff** — *what changed?* Headless Ghidra binary diff between two builds,\n  rendered as shareable markdown — for n-day \u002F Patch-Tuesday research and\n  variant hunting.\n\n**Framing:** This is defensive triage and authorized RE. Use it on samples you\nare authorized to analyze (your own, quarantined, sandbox-detonated, CTF, or\nvendor patches). Every capability you find should feed a *detection*, not an\nattack — see the Defensive Pairing column below.\n\n## When to Use\n\n- You have an unknown\u002Fsuspicious executable and need a fast behavior summary.\n- `strings` returned nothing useful but the sample is clearly doing something.\n- You need MITRE ATT&CK technique IDs to write or validate Sigma\u002FEDR\u002FYARA rules.\n- You want to know exactly which functions to reverse first (jump to addresses).\n- A vendor shipped a patch and you need to find the fixed code path (n-day).\n\n**When NOT to use:** dynamic\u002Fsandbox detonation (use CAPE\u002FDRAKVUF\u002FVMRay, then\nfeed their JSON to capa); live debugging (use `$reverse-engineering-toolkit`);\n\n### Install (Windows, this workspace)\n### Quick Reference\n### Defensive Pairing (turn findings into detections)\n### Gotchas\n### Workflow\n### Related\n","# Malware Analysis Triage (capa \u002F FLOSS \u002F ghidriff)\n\n## Overview\n\nThree FLARE\u002FMandiant defensive CLIs that turn an unknown blob into actionable\nintelligence in seconds, before you sink hours into IDA\u002FGhidra:\n\n- **capa** — *what can this binary do?* Static capability detection mapped to\n  MITRE ATT&CK and MBC (persistence, C2, injection, anti-analysis, crypto).\n- **FLOSS** — *what is it hiding?* Recovers stack \u002F tight \u002F decoded strings that\n  plain `strings` cannot see (C2 URLs, keys, mutexes, config).\n- **ghidriff** — *what changed?* Headless Ghidra binary diff between two builds,\n  rendered as shareable markdown — for n-day \u002F Patch-Tuesday research and\n  variant hunting.\n\n**Framing:** This is defensive triage and authorized RE. Use it on samples you\nare authorized to analyze (your own, quarantined, sandbox-detonated, CTF, or\nvendor patches). Every capability you find should feed a *detection*, not an\nattack — see the Defensive Pairing column below.\n\n## When to Use\n\n- You have an unknown\u002Fsuspicious executable and need a fast behavior summary.\n- `strings` returned nothing useful but the sample is clearly doing something.\n- You need MITRE ATT&CK technique IDs to write or validate Sigma\u002FEDR\u002FYARA rules.\n- You want to know exactly which functions to reverse first (jump to addresses).\n- A vendor shipped a patch and you need to find the fixed code path (n-day).\n\n**When NOT to use:** dynamic\u002Fsandbox detonation (use CAPE\u002FDRAKVUF\u002FVMRay, then\nfeed their JSON to capa); live debugging (use `$reverse-engineering-toolkit`);\n\n### Install (Windows, this workspace)\n### Quick Reference\n### Defensive Pairing (turn findings into detections)\n### Gotchas\n### Workflow\n### Related\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5","platform\u002Frouting\u002Ffixtures\u002Fhome\u002F.agents\u002Fskills\u002Fmalware-analysis-triage","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage",{"tool":50,"command":51},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage",{"tool":53,"command":54},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill malware-analysis-triage","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Fplatform\u002Frouting\u002Ffixtures\u002Fhome\u002F.agents\u002Fskills\u002Fmalware-analysis-triage\u002FSKILL.md",true,[],[59,80,111,138,152,168],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":33},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[66,67,68,69,70,71,72,73,74,28,75,76,77,78,79],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","context","repo","injection","execution","file",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":91,"publishedAt":33},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[92,93,94,95,96,97,98,99,100,101,102,103,104,105,28,106,107,108,109,110],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":123,"publishedAt":33},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[117,120],{"categoryNo":118,"categoryName":119,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":121,"categoryName":122,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000008","测试与质量",[124,125,126,127,128,129,130,131,132,133,93,134,135,136,137],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":33},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[140,145,146,147,148,149,150,151],"setup","report","project","installation","project setup","issues","state",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":33},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[158],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},[154,160,71,161,162,163,28,164,165,166,167],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":169,"name":145,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":33},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[145,147,108,174,149,175],"files","interactive"]