reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/.github/copilot-instructions.md

@@ -0,0 +1,50 @@
+# AnalystAIPack — GitHub Copilot instructions
+
+This workspace is **AnalystAIPack**, a library of 118 security skills for **malware analysis,
+reverse engineering, and threat hunting**. Each skill is a folder under `skills/` containing a
+`SKILL.md` (procedure) and a runnable `scripts/analyst.py` (a static, read-only analysis tool).
+
+## How to help in this repo
+
+- When the user asks an analysis/hunting task, **find the matching skill first** instead of
+  improvising. Discover skills with:
+  - `python tools/analyst-pack.py search <topic>`
+  - `python tools/analyst-pack.py list [--subdomain malware-analysis|reverse-engineering|threat-hunting|lab-foundations]`
+  - `python tools/analyst-pack.py show <skill-name>`
+- Read the chosen `skills/<name>/SKILL.md` and follow its **Workflow**. Honor its
+  `When to Use` and especially the **Do not use** boundary.
+- Run a skill's tool via:
+  `python tools/analyst-pack.py run <skill-name> -- <subcommand> <args>`
+  or directly `python skills/<skill-name>/scripts/analyst.py <subcommand> <args>`.
+  Output is structured JSON — pass it forward to the next skill or into a report.
+
+## Safety rules (do not violate)
+
+- **Never execute a malware sample.** All scripts are static and read-only. Do not write code
+  that runs, detonates, or connects to a sample's infrastructure.
+- **Assume an isolated lab** for any live-sample step; follow each skill's `Safety & Handling`.
+- **Keep IOCs defanged** in output (`hxxp://`, `1[.]2[.]3[.]4`). The scripts already do this —
+  preserve it.
+- **No live samples in the repo** (see `.gitignore`). Some scripts contain malware *signature
+  strings* for detection; antivirus may flag the file text — that is static data, not behavior.
+
+## Authoring or editing a skill
+
+Keep the repo green and follow the conventions:
+
+- Each skill needs: `SKILL.md` + `scripts/analyst.py` + `references/api-reference.md` + `LICENSE`.
+- Frontmatter: `name` (kebab == folder), `description` (ends with an "Activates for …" trigger),
+  `domain: cybersecurity`, `subdomain` (one of the four), `tags`, `version`, `author`, `license`,
+  and framework IDs (`mitre_attack`, `d3fend`, optional `car`).
+- Body sections in order: `When to Use` (with **Do not use**), `Prerequisites`,
+  `Safety & Handling` (sample-handling skills), `Workflow`, `Validation`, `Pitfalls`, `References`.
+- Scripts are **standard-library only** (optional deps degrade gracefully) and never execute the
+  sample. Validate with:
+
+```bash
+python tools/lint-skills.py --all
+python tools/build-index.py && python tools/build-catalog.py && python tools/build-navigator-layer.py
+python tools/smoke-test.py
+```
+
+See `AGENTS.md` (full operating guide) and `CONTRIBUTING.md` (originality rules).

vendor-new/analyst-ai-pack/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: ci
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate, build artifacts, and smoke-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Core runtime is stdlib-only; no dependency install step is required.
+
+      - name: Lint all skills
+        run: python tools/lint-skills.py --all
+
+      - name: Verify index.json is current
+        run: python tools/build-index.py --check
+
+      - name: Verify ATT&CK Navigator layer is current
+        run: python tools/build-navigator-layer.py --check
+
+      - name: Verify CATALOG.md is current
+        run: python tools/build-catalog.py --check
+
+      - name: Byte-compile every skill script
+        run: |
+          python -m compileall -q skills tools
+
+      - name: Smoke-test all skill scripts
+        run: python tools/smoke-test.py
+
+      - name: Smoke-test the analyst-pack CLI
+        run: |
+          python tools/analyst-pack.py stats
+          python tools/analyst-pack.py list