Show HN: AnalystAIPack – 118 runnable agent skills for malware analysis and RE

AnalystAIPack: Giving an AI Agent a Malware Analyst's Working Knowledge | Melted in HexAnalystAIPack: Giving an AI Agent a Malware Analyst's Working Knowledge AnalystAIPack is an open, Apache-2.0 library of runnable agent skills that give an AI agent a malware analyst's working knowledge across analysis, RE, and threat hunting. July 1, 2026 · 5 min · 1041 words · Melted in Hex Table of ContentsWhat It Is A Worked Example: From Sample to Detection How to Use It A Note on Safety Try It

Ask a general-purpose AI agent to analyze a suspicious executable and you get confident-sounding mush. It will happily tell you to “check the file for anything malicious,” suggest a plugin that does not exist, or skip the one step that actually matters. The model knows a lot about malware analysis. What it lacks is the analyst’s working knowledge: which Volatility 3 plugin to run on a memory image, how to reach a packer’s original entry point, how to turn a recovered C2 config into a Sigma rule, and, just as important, when not to trust a result. That gap is what I built AnalystAIPack to close. It is an open, Apache-2.0 library of 118 agent skills for malware analysis, reverse engineering, and threat hunting, and it is now public on GitHub. What It Is# AnalystAIPack is a library of ready-to-load skills in the agentskills.io SKILL.md format, so it drops straight into GitHub Copilot, Claude Code, Cursor, Codex CLI, Gemini CLI, or any compatible agent. It is deliberately depth-first : instead of a sprawling catalog that touches everything shallowly, it covers four tightly-scoped subdomains that map to how an analyst actually works.

The library is split into four tightly-scoped subdomains, 118 curated skills in total, arranged around the real analyst workflow. SubdomainWhat it coverslab-foundationsSafe handling, lab setup, triage, hashing, file ID, IOC formats, reportingmalware-analysisStatic, dynamic, behavioral, and memory analysis; document and script malware; familiesreverse-engineeringDisassembly and decompilation, unpacking, deobfuscation, anti-analysis defeat, language-specific REthreat-huntingHypothesis-driven hunts, endpoint, network and identity telemetry, detection engineeringThree things separate it from a folder full of prompts. Every skill is runnable. All 118 skills ship a tested scripts/analyst.py that performs the analysis, not just a description of it. They lean on the Python standard library, degrade gracefully when an optional dependency is missing, and are covered by a repo-wide smoke-test harness and CI gates. The tooling actually works, it does not just read well. Safe by construction. The scripts perform static, read-only analysis and never execute the sample . IOCs come out defanged (hxxp://, 1[.]2[.]3[.]4), and every sample-handling skill carries an explicit Safety & Handling section that assumes an isolated lab. The repository ships no live malware. A defender’s framework lens. Skills map to MITRE ATT&CK , MITRE D3FEND , and, for hunts, MITRE CAR , chosen because they fit reverse engineering, malware analysis, and threat hunting far better than compliance checklists. That mapping lets an agent report coverage and slot findings into detection engineering. Every skill follows the same body contract, When to Use (with an explicit Do not use ), Workflow, Validation, and Pitfalls, so the agent always knows the boundaries of a technique instead of applying it blindly.

Each skill pairs an opinionated SKILL.md procedure with a tested, read-only analyst.py that prints structured, defanged JSON. A Worked Example: From Sample to Detection# The point of a depth-first library is that the skills chain. Each one is a step, and strung together they cover the full analyst loop. Here is what triaging a suspicious executable looks like end to end:

Eight skills, chained: from an unknown suspicious.exe through to a durable detection, with each script’s JSON feeding the next. #StageSkill1Triage the unknown filetriaging-an-unknown-sample2Static PE inspectionperforming-static-pe-analysis3Spot packing via entropymeasuring-section-entropy-to-detect-packing4Unpack to the OEPmanually-unpacking-a-packed-binary5Recover the C2 configextracting-cobalt-strike-beacon-config6Defang and package IOCsdefanging-and-sharing-iocs7Hunt the IOCs in traffichunting-cobalt-strike-traffic8Write a durable detectionwriting-sigma-detection-rulesDriven from the CLI, the mechanical steps are just: # 1. Triage, then 5. recover the beacon config (read-only, never executes the sample) python tools/analyst-pack.py run triaging-an-unknown-sample -- triage suspicious.exe python tools/analyst-pack.py run extracting-cobalt-strike-beacon-config -- parse beacon.bin

# 7. Hunt the recovered indicators in proxy/Zeek logs, 8. emit a Sigma rule python tools/analyst-pack.py run hunting-cobalt-strike-traffic -- hunt http.csv

Every script prints structured, defanged JSON, so the output of one step feeds straight into the next, into...

Show HN: AnalystAIPack – 118 runnable agent skills for malware analysis and RE

Related Articles

(no title)

Is AI ruining our skills? Early results are in – and they're not good

The Anatomy of an AI-Native Org

Apertus – Open Foundation Model for Sovereign AI

The labor share of income in the US is at its lowest post-war level