Is ctf-malware safe to install?

SaferSkills independently audited ctf-malware (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/ctf-malware/SKILL.md · 1 file

skills/ctf-malware/SKILL.md3.6 KB · Markdown

name: ctf-malware

description: Malware & network analysis: obfuscated JS/PowerShell/VBA, PE/.NET analysis, PyInstaller/PyArmor, custom C2 protocols (RC4, AES, DNS), YARA rules, shellcode, memory-forensics IOCs, anti-sandbox/anti-VM bypass.

license: MIT

compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation.

allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch

metadata:

user-invocable: "false"

CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Additional Resources

scripts-and-obfuscation.md - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection)
c2-and-protocols.md - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
pe-and-dotnet.md - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor

Pattern Recognition Index

Dispatch on byte/file signals, never the sample's reputation.

Signal	Technique → file
File starts with `PK` + contains `package.json` + `.vsix` extension	VSCode extension activation-event exfil → scripts-and-obfuscation.md
High-entropy `extension.js`/`index.js` > 50 KB with `child_process`	JS obfuscator.io / JSFuck deobfuscation → scripts-and-obfuscation.md
PowerShell `-enc <b64>` or IEX in parent process logs	PS script decode + reflection assembly → scripts-and-obfuscation.md
PCAP with custom TCP port, payload bytes distributed uniformly	Custom crypto / RC4 / AES session key recovery → c2-and-protocols.md
PCAP with `DNS TXT` records carrying base32/64 blobs	DNS-based C2 exfil → c2-and-protocols.md
PCAP where specific User-Agent receives non-default responses	UA-gated C2 path-hex-XOR → (see ctf-forensics/network-advanced.md)
PE32/PE64 with `.text` sections having packer signatures (UPX, VMProtect, Themida)	Unpacking + dump-after-decrypt → pe-and-dotnet.md
.NET assembly with obfuscated strings + reflection calls	dnSpy + de4dot + string decryption → pe-and-dotnet.md
PyInstaller binary (`MEIPASS`, `_MEIxxxx` strings)	pyinstxtractor + pycdc → pe-and-dotnet.md
Process-injection IoCs in memory dump (`RWX` allocations, `NtUnmapViewOfSection`)	Volatility `malfind` + process hollowing detection → scripts-and-obfuscation.md
Anti-VM checks (`cpuid` hypervisor bit, RDTSC timing, specific drivers)	VM-detection bypass in analysis sandbox → scripts-and-obfuscation.md
WebSocket frame with visible RC4 key-setup or KSA signatures	RC4 WebSocket reversing → c2-and-protocols.md

Recognize the artefact or protocol pattern. The sample's name is not a signal.

For inline snippets and quick-reference tables, see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first.

ctf-malware— agent skill

Is ctf-malware safe to install?

CTF Malware & Network Analysis

Additional Resources

Pattern Recognition Index

Audit the pieces. Scan the whole. Decide.