Skill Title

Replace every bracketed placeholder. Delete this quote block and the Safety & Handling section if the skill does not touch live malware samples. Keep section order.

When to Use

• [Concrete trigger: a situation where this skill is the right tool]
• [Another trigger]
• [Another trigger]

Do not use for [explicit out-of-scope cases]; instead reach for [the correct skill].

Prerequisites

• [Tool + minimum version, with install/download pointer]
• [Lab/environment requirement]
• [Prior knowledge or input artifact required]

Safety & Handling

(Sample-handling skills only — delete otherwise.)

• Work only inside an isolated analysis VM with no path to production or the internet unless deliberately routed through a controlled gateway.
• Store samples encrypted or in password-protected archives (password infected); never leave live samples loose on disk.
• Defang indicators (hxxp://, 1.2.3[.]4) in any output that leaves the lab.
• Never execute a sample on the host or detonate outside the sandbox.

Workflow

Step 1: [Action]

[What to do and why.]

# Real, runnable command — not pseudocode
tool --do-the-thing sample.bin

Step 2: [Action]

[Explanation.]

# Original example code

Step 3: [Action]

[Explanation.]

Validation

• [How to confirm the analysis/hunt produced a correct, trustworthy result]
• [A cross-check or second method to corroborate findings]

Pitfalls

• [Common mistake and how to avoid it]
• [Evasion trick or false-positive trap to watch for]

References

• See references/api-reference.md for tooling details and the full list of sources this skill was synthesized from.
• [Key external source — title and URL]