reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/handling-malware-samples-safely/references/api-reference.md

@@ -0,0 +1,47 @@
+# API Reference: Handling Malware Samples Safely
+
+## Overview
+
+`scripts/analyst.py` provides three safe, read-only operations: computing a sample's hash
+identity, emitting a provenance record, and defanging IOCs before sharing. It never executes
+a sample.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | Hashing, JSON, regex |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| 7-Zip | Encrypted, password-protected sample archives (`-p`, `-mhe=on`) |
+| certutil / sha256sum | Hashing outside Python where convenient |
+
+## Core functions
+
+### `compute_hashes(filepath)`
+Returns `md5`, `sha1`, `sha256`, `size` for identification.
+
+### `make_record(filepath, source, case)`
+Returns a provenance dict: case, source, filename, UTC timestamp, and hashes.
+
+### `defang(text)`
+Rewrites `http(s)://` to `hxxp(s)://` and brackets dots in URLs/IPs so indicators are not
+clickable.
+
+## Usage
+
+```bash
+python scripts/analyst.py hash sample.bin
+python scripts/analyst.py record sample.bin --source MalwareBazaar --case CASE-001
+python scripts/analyst.py defang iocs.txt
+```
+
+## Sources
+
+- MalwareBazaar (abuse.ch) sample-sharing conventions — https://bazaar.abuse.ch/
+- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response —
+  https://csrc.nist.gov/pubs/sp/800/86/final
+- 7-Zip command-line documentation (vendor)