DANGER

malware detected

github.com / mukul975

mukul975/Anthropic-Cybersecurity-Skills

Python·4532 files·commit 1b3f6b2·scanned 4d ago·cached ✓

100/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

31,012 stars

Crypto/Web3 project

24% file coverage

Research / educational context

Partial architecture graph

threat-state: maliciouslive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.skills/analyzing-email-headers-for-phishing-investigation/scripts/agent.py

    """Perform DNS lookup for SPF/DKIM/DMARC records."""
    stdout, _, rc = subprocess.run(
        ["dig", record_type, domain, "+short"],
        capture_output=True, text=True, timeout=10

                    findings.extend(_scan_cron_file(full_path))
    user_crontabs = subprocess.run(
        ["bash", "-c", "for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u $u 2>/dev/null && echo...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.skills/analyzing-supply-chain-malware-artifacts/scripts/agent.py

        (r"exec\(", "exec() code execution"),
        (r"eval\(", "eval() code execution"),
        (r"base64\.b64decode", "Base64 decoding"),
        (r"socket\.", "Network socket usage"),

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.skills/analyzing-supply-chain-malware-artifacts/scripts/agent.py

        (r"subprocess\.", "subprocess execution"),
        (r"exec\(", "exec() code execution"),
        (r"eval\(", "eval() code execution"),
        (r"base64\.b64decode", "Base64 decoding"),

    patterns = [
        (r"os\.system\(", "os.system() execution"),
        (r"subprocess\.", "subprocess execution"),
        (r"exec\(", "exec() code execution"),

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.skills/building-incident-response-dashboard/scripts/agent.py

    | stats count AS assigned, dc(rule_name) AS rule_types,
            avg(eval(if(status_label="Resolved*", (status_end - _time)/3600, null()))) AS avg_resolve_hrs
      by owner
    | sort - assign...

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.skills/building-incident-response-dashboard/scripts/agent.py

    | stats count AS assigned, dc(rule_name) AS rule_types,
            avg(eval(if(status_label="Resolved*", (status_end - _time)/3600, null()))) AS avg_resolve_hrs
      by owner
    | sort - assign...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.skills/building-soc-metrics-and-kpi-tracking/scripts/agent.py

        "| stats count AS total, "
        'sum(eval(if(status_label="Resolved - True Positive", 1, 0))) AS tp, '
        'sum(eval(if(status_label="Resolved - False Positive", 1, 0))) AS fp '
       ...

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.skills/building-soc-metrics-and-kpi-tracking/scripts/agent.py

        "| stats count AS total, "
        'sum(eval(if(status_label="Resolved - True Positive", 1, 0))) AS tp, '
        'sum(eval(if(status_label="Resolved - False Positive", 1, 0))) AS fp '
       ...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.skills/deobfuscating-javascript-malware/scripts/agent.py

        techniques.append("eval_chain")
    if "new Function(" in code or "new Function (" in code:
        techniques.append("function_constructor")
    if re.search(r'document\.write\s*\(', code):

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.skills/detecting-serverless-function-injection/scripts/agent.py

        {"pattern": r"\beval\s*\(", "sink": "eval()", "severity": "critical", "cwe": "CWE-95"},
        {"pattern": r"\bnew\s+Function\s*\(", "sink": "new Function()", "severity": "critical", "cwe": "...

criticalPython remote code executionFetching code from a remote URL and immediately executing it (exec(requests.get(...).text)) is a classic malware dropper pattern.skills/testing-for-xss-vulnerabilities-with-burpsuite/scripts/agent.py


import requests
import re
import json

+10

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.skills/analyzing-browser-forensics-with-hindsight/scripts/agent.py+5

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.skills/deobfuscating-javascript-malware/scripts/agent.py

def decode_atob_calls(code):
    """Resolve atob() calls containing static base64 strings."""
    def atob_replace(match):
        try:

criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.skills/detecting-shadow-it-cloud-usage/scripts/agent.py+5

criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.skills/hunting-for-data-exfiltration-indicators/scripts/process.py+5

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.skills/analyzing-browser-forensics-with-hindsight/scripts/agent.py

    candidates = [
        os.path.join(home, "AppData", "Local", "Google", "Chrome", "User Data", "Default"),
        os.path.join(home, "AppData", "Local", "Microsoft", "Edge", "User Data", "Default...

+10

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.skills/analyzing-linux-audit-logs-for-intrusion/scripts/agent.py

    "/etc/passwd", "/etc/shadow", "/etc/sudoers",
    "/etc/ssh/sshd_config", "/root/.ssh/authorized_keys",
    "/etc/crontab", "/var/spool/cron",
]

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.skills/analyzing-linux-elf-malware/scripts/agent.py

            categorized["persistence"].append(s)
        if any(p in s_lower for p in ["ssh", "authorized_keys", "id_rsa", "shadow", "passwd"]):
            categorized["ssh_related"].append(s)
      ...

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.skills/analyzing-linux-system-artifacts/scripts/agent.py

    key_files = glob.glob(
        os.path.join(evidence_root, "home/*/.ssh/authorized_keys")
    ) + glob.glob(
        os.path.join(evidence_root, "root/.ssh/authorized_keys")

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.skills/performing-credential-access-with-lazagne/scripts/agent.py

        r"%APPDATA%\Mozilla\Firefox\Profiles",
        r"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data",
        r"%APPDATA%\Opera Software\Opera Stable\Login Data",
        # Linux

+10

            "/Users/*/NTUSER.DAT",
            "/Users/*/AppData/Local/Google/Chrome",
            "/Users/*/AppData/Roaming/Mozilla/Firefox",
            "/$MFT",

+10

warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.skills/analyzing-bootkit-and-rootkit-samples/scripts/agent.py

    b"\xE8\x00\x00\x5E\x81\xEE": "TDL4/Alureon bootkit",
    b"\xFA\x33\xC0\x8E\xD0\xBC\x00\x7C\x8B\xF4\x50\x07": "Standard Windows MBR (clean)",
    b"\xEB\x5A\x90\x4E\x54\x46\x53": "Standard NTFS VB...

warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.skills/exploiting-ms17-010-eternalblue-vulnerability/scripts/agent.py

    b"\x62\x00"          # ByteCount
    b"\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f"
    b"\x47\x52\x41\x4d\x20\x31\x2e\x30\x00"
    b"\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"

criticalObfuscated crypto project with remote network activityThe repository is obfuscated and makes remote network calls within a crypto/Web3 context. This combination is typical of concealed wallet drainers.+10

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.skills/abusing-shadow-credentials-for-privesc/scripts/agent.py+3

warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.skills/achieving-cmmc-level-2-compliance/scripts/process.py+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.skills/acquiring-disk-image-with-dd-and-dcfldd/scripts/agent.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.skills/analyzing-powershell-script-block-logging/scripts/agent.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.skills/auditing-tls-certificate-transparency-logs/scripts/agent.py+3

infoSuspicious file in repoExecutable file (Deploy-ADHoneytokens.ps1) in repositoryskills/deploying-active-directory-honeytokens/scripts/Deploy-ADHoneytokens.ps1+2

infoSuspicious file in repoExecutable file (audit_smb_signing.ps1) in repositoryskills/detecting-ntlm-relay-with-event-correlation/scripts/audit_smb_signing.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1109 files scanned @ 1b3f6b2 | 8/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration25

file system access20

obfuscation15

supply chain4

owasp / injection0

telemetry

files 1109/4532rules hit 34engine v5commit 1b3f6b2

github

mukul975/Anthropic-Cybersecurity-Skills

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

Python

31012

3694

185d

4532 files

1109 scanned(24%)

1b3f6b2

architecture░▒▓

entry (0) flagged (344) pkg (176)

576 nodes · 2117 edgesscroll to zoom · click node to jump to finding