vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
da24c2bd206830822af121457bf51692ef7fc3aa
reverse-skills-max/vendor-new/analyst-ai-pack/.github/copilot-instructions.md

2.7 KiB
Raw Blame History

AnalystAIPack — GitHub Copilot instructions

This workspace is AnalystAIPack, a library of 118 security skills for malware analysis, reverse engineering, and threat hunting. Each skill is a folder under skills/ containing a SKILL.md (procedure) and a runnable scripts/analyst.py (a static, read-only analysis tool).

How to help in this repo

  • When the user asks an analysis/hunting task, find the matching skill first instead of improvising. Discover skills with:
    • python tools/analyst-pack.py search <topic>
    • python tools/analyst-pack.py list [--subdomain malware-analysis|reverse-engineering|threat-hunting|lab-foundations]
    • python tools/analyst-pack.py show <skill-name>
  • Read the chosen skills/<name>/SKILL.md and follow its Workflow. Honor its When to Use and especially the Do not use boundary.
  • Run a skill's tool via: python tools/analyst-pack.py run <skill-name> -- <subcommand> <args> or directly python skills/<skill-name>/scripts/analyst.py <subcommand> <args>. Output is structured JSON — pass it forward to the next skill or into a report.

Safety rules (do not violate)

  • Never execute a malware sample. All scripts are static and read-only. Do not write code that runs, detonates, or connects to a sample's infrastructure.
  • Assume an isolated lab for any live-sample step; follow each skill's Safety & Handling.
  • Keep IOCs defanged in output (hxxp://, 1[.]2[.]3[.]4). The scripts already do this — preserve it.
  • No live samples in the repo (see .gitignore). Some scripts contain malware signature strings for detection; antivirus may flag the file text — that is static data, not behavior.

Authoring or editing a skill

Keep the repo green and follow the conventions:

  • Each skill needs: SKILL.md + scripts/analyst.py + references/api-reference.md + LICENSE.
  • Frontmatter: name (kebab == folder), description (ends with an "Activates for …" trigger), domain: cybersecurity, subdomain (one of the four), tags, version, author, license, and framework IDs (mitre_attack, d3fend, optional car).
  • Body sections in order: When to Use (with Do not use), Prerequisites, Safety & Handling (sample-handling skills), Workflow, Validation, Pitfalls, References.
  • Scripts are standard-library only (optional deps degrade gracefully) and never execute the sample. Validate with:
python tools/lint-skills.py --all
python tools/build-index.py && python tools/build-catalog.py && python tools/build-navigator-layer.py
python tools/smoke-test.py

See AGENTS.md (full operating guide) and CONTRIBUTING.md (originality rules).