reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Writing a Malware Analysis Report
+
+## Overview
+
+`scripts/analyst.py` generates a structured Markdown report skeleton and checks a draft for the
+required sections, presence of ATT&CK technique IDs, and accidental clickable URLs.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | Templating, regex, file IO |
+
+## Core functions
+
+### `scaffold(sha256, name)`
+Returns a complete Markdown report template with the standard section order and example
+tables for identity, capabilities, IOCs, and detection.
+
+### `check(text)`
+Returns a list of completeness problems: missing required sections, no ATT&CK IDs, or
+clickable URLs that should be defanged.
+
+## Usage
+
+```bash
+python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
+python scripts/analyst.py check report.md
+```
+
+## Sources
+
+- MITRE ATT&CK technique catalog — https://attack.mitre.org/
+- MISP core format and STIX 2.1 for structured IOC representation —
+  https://www.misp-project.org/
+- Common DFIR reporting structure (executive summary → identity → capabilities → IOCs →
+  detection), standard practice across CERT/IR teams