reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/templates/skill-template/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/templates/skill-template/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: skill-template
+description: 'One to three sentences describing what this skill does and the conditions
+  under which an agent should activate it. Start with a verb, name the tools and artifacts
+  involved, and end with the trigger phrasing (e.g. "Activates for requests involving ...").'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - tag-one
+  - tag-two
+  - tag-three
+  - tag-four
+  - tag-five
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T0000
+d3fend:
+  - D3-XXX
+car:
+  - CAR-0000-00-000
+references:
+  - 'Source title — https://example.com/primary-source'
+---
+
+# Skill Title
+
+> Replace every bracketed placeholder. Delete this quote block and the `Safety & Handling`
+> section if the skill does not touch live malware samples. Keep section order.
+
+## When to Use
+
+- [Concrete trigger: a situation where this skill is the right tool]
+- [Another trigger]
+- [Another trigger]
+
+**Do not use** for [explicit out-of-scope cases]; instead reach for [the correct skill].
+
+## Prerequisites
+
+- [Tool + minimum version, with install/download pointer]
+- [Lab/environment requirement]
+- [Prior knowledge or input artifact required]
+
+## Safety & Handling
+
+*(Sample-handling skills only — delete otherwise.)*
+
+- Work only inside an isolated analysis VM with no path to production or the internet
+  unless deliberately routed through a controlled gateway.
+- Store samples encrypted or in password-protected archives (password `infected`); never
+  leave live samples loose on disk.
+- Defang indicators (`hxxp://`, `1.2.3[.]4`) in any output that leaves the lab.
+- Never execute a sample on the host or detonate outside the sandbox.
+
+## Workflow
+
+### Step 1: [Action]
+
+[What to do and why.]
+
+```bash
+# Real, runnable command — not pseudocode
+tool --do-the-thing sample.bin
+```
+
+### Step 2: [Action]
+
+[Explanation.]
+
+```python
+# Original example code
+```
+
+### Step 3: [Action]
+
+[Explanation.]
+
+## Validation
+
+- [How to confirm the analysis/hunt produced a correct, trustworthy result]
+- [A cross-check or second method to corroborate findings]
+
+## Pitfalls
+
+- [Common mistake and how to avoid it]
+- [Evasion trick or false-positive trap to watch for]
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for tooling details and
+  the full list of sources this skill was synthesized from.
+- [Key external source — title and URL]

vendor-new/analyst-ai-pack/templates/skill-template/references/api-reference.md

@@ -0,0 +1,41 @@
+# API Reference: <Skill Title>
+
+## Overview
+
+[One paragraph: what `scripts/analyst.py` automates and how it fits the skill workflow.]
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | Hashing, JSON, paths |
+| [pkg] | >= x.y | [why] |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| [tool] | [what it provides] |
+
+## Core functions
+
+### `analyze(target)`
+[What it does, what it returns.]
+
+### `compute_hashes(filepath)`
+Returns `md5`, `sha1`, `sha256`, and `size` for file identification.
+
+## Usage
+
+```bash
+python scripts/analyst.py path/to/artifact --json
+```
+
+## Sources
+
+This skill was synthesized from the following primary sources. List the specific pages,
+docs, specs, or reports used — not generic homepages. (See CONTRIBUTING.md.)
+
+- [Source title — URL]
+- [Source title — URL]
+- [Source title — URL]

vendor-new/analyst-ai-pack/templates/skill-template/scripts/analyst.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Runnable tooling for the <skill-name> skill.
+
+Replace this module with original code that automates the skill's workflow. Keep it
+self-contained, dependency-light, and safe to run. Document every public function in
+``references/api-reference.md``.
+
+Authoring rules (see CONTRIBUTING.md):
+- Original code only. Do not lift or reword scripts from other skill repositories.
+- Lint with ``ruff`` before committing.
+- Fail safe: never execute a malware sample on the host; operate on files, logs, or
+  telemetry only.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+
+def compute_hashes(filepath: str | Path) -> dict[str, str | int]:
+    """Return MD5/SHA-1/SHA-256 and size for a file, for identification only."""
+    data = Path(filepath).read_bytes()
+    return {
+        "md5": hashlib.md5(data).hexdigest(),  # noqa: S324 - identification, not security
+        "sha1": hashlib.sha1(data).hexdigest(),  # noqa: S324
+        "sha256": hashlib.sha256(data).hexdigest(),
+        "size": len(data),
+    }
+
+
+def analyze(target: str | Path) -> dict:
+    """Entry point for the skill's core logic. Replace with real implementation."""
+    target = Path(target)
+    if not target.exists():
+        raise FileNotFoundError(target)
+    return {
+        "target": str(target),
+        "hashes": compute_hashes(target),
+        "findings": [],
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="AnalystAIPack skill tool")
+    parser.add_argument("target", help="path to the file or artifact to analyze")
+    parser.add_argument("--json", action="store_true", help="emit JSON output")
+    args = parser.parse_args(argv)
+
+    result = analyze(args.target)
+    if args.json:
+        print(json.dumps(result, indent=2))
+    else:
+        for key, value in result.items():
+            print(f"{key}: {value}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())