95 lines
2.4 KiB
Markdown
95 lines
2.4 KiB
Markdown
---
|
|
name: skill-template
|
|
description: 'One to three sentences describing what this skill does and the conditions
|
|
under which an agent should activate it. Start with a verb, name the tools and artifacts
|
|
involved, and end with the trigger phrasing (e.g. "Activates for requests involving ...").'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- tag-one
|
|
- tag-two
|
|
- tag-three
|
|
- tag-four
|
|
- tag-five
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T0000
|
|
d3fend:
|
|
- D3-XXX
|
|
car:
|
|
- CAR-0000-00-000
|
|
references:
|
|
- 'Source title — https://example.com/primary-source'
|
|
---
|
|
|
|
# Skill Title
|
|
|
|
> Replace every bracketed placeholder. Delete this quote block and the `Safety & Handling`
|
|
> section if the skill does not touch live malware samples. Keep section order.
|
|
|
|
## When to Use
|
|
|
|
- [Concrete trigger: a situation where this skill is the right tool]
|
|
- [Another trigger]
|
|
- [Another trigger]
|
|
|
|
**Do not use** for [explicit out-of-scope cases]; instead reach for [the correct skill].
|
|
|
|
## Prerequisites
|
|
|
|
- [Tool + minimum version, with install/download pointer]
|
|
- [Lab/environment requirement]
|
|
- [Prior knowledge or input artifact required]
|
|
|
|
## Safety & Handling
|
|
|
|
*(Sample-handling skills only — delete otherwise.)*
|
|
|
|
- Work only inside an isolated analysis VM with no path to production or the internet
|
|
unless deliberately routed through a controlled gateway.
|
|
- Store samples encrypted or in password-protected archives (password `infected`); never
|
|
leave live samples loose on disk.
|
|
- Defang indicators (`hxxp://`, `1.2.3[.]4`) in any output that leaves the lab.
|
|
- Never execute a sample on the host or detonate outside the sandbox.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: [Action]
|
|
|
|
[What to do and why.]
|
|
|
|
```bash
|
|
# Real, runnable command — not pseudocode
|
|
tool --do-the-thing sample.bin
|
|
```
|
|
|
|
### Step 2: [Action]
|
|
|
|
[Explanation.]
|
|
|
|
```python
|
|
# Original example code
|
|
```
|
|
|
|
### Step 3: [Action]
|
|
|
|
[Explanation.]
|
|
|
|
## Validation
|
|
|
|
- [How to confirm the analysis/hunt produced a correct, trustworthy result]
|
|
- [A cross-check or second method to corroborate findings]
|
|
|
|
## Pitfalls
|
|
|
|
- [Common mistake and how to avoid it]
|
|
- [Evasion trick or false-positive trap to watch for]
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for tooling details and
|
|
the full list of sources this skill was synthesized from.
|
|
- [Key external source — title and URL]
|