Show HN: AnalystAIPack – 118 runnable agent skills for malware analysis and RE

AnalystAIPack: Giving an AI Agent a Malware Analyst's Working Knowledge Published July 1, 2026 | 5 min read | 1041 words | Melted in Hex

When you ask a standard, general-purpose AI agent to dissect a suspicious executable, the result is often accurate "confident-sounding mush."

The AI might suggest non-existent plugins, tell you to "check for malicious activity" without explaining how, or completely overlook the critical step that leads to a breakthrough. This happens because the AI lacks working knowledge—the practical, "in-the-trenches" expertise of a human analyst. It doesn't instinctively know which Volatility 3 plugin to apply to a memory dump, how to locate a packer's Original Entry Point (OEP), or the precise method for converting a recovered C2 configuration into a functional Sigma rule. Crucially, it doesn't know when to distrust a result.

To bridge this gap, AnalystAIPack has been released. It is an open-source, Apache-2.0 licensed library containing 118 runnable agent skills specifically designed for malware analysis, reverse engineering (RE), and threat hunting.

---

🛠️ What It Is

AnalystAIPack provides ready-to-load skills utilizing the agentskills.io SKILL.md format. This ensures seamless integration with modern AI agents, including:

• GitHub Copilot
• Claude Code
• Cursor
• Codex CLI
• Gemini CLI

Rather than offering a shallow overview of every possible security topic, the library is depth-first. It focuses on four tightly-scoped subdomains that mirror the actual operational workflow of a professional analyst.

Library Architecture

Why this isn't just a "Prompt Pack"

AnalystAIPack differs from a simple collection of prompts in three fundamental ways:

1. Executable Logic: Every one of the 118 skills includes a tested scripts/analyst.py file. The agent doesn't just describe the analysis; it performs it.
2. Stability & Safety:
   • Scripts rely primarily on the Python standard library.
   • They are validated via a repo-wide smoke-test harness and CI gates.
   • Crucial: All scripts perform static, read-only analysis. They execute the malware never execute the sample.
   • IOCs are automatically defanged (e.g., hxxp:// or 1[.]2[.]3[.]4).
   • Every skill contains a mandatory Safety & Handling section assuming an isolated lab environment.
3. Industry Mapping: Skills are mapped to $\text{MITRE ATT\&CK}$, $\text{MITRE D3FEND}$, and $\text{MITRE CAR}$. This is far more effective for RE and threat hunting than generic compliance checklists, allowing agents to report coverage and integrate findings directly into detection engineering.

Each skill adheres to a strict contract:

• When to Use (including an explicit Do not use section)
• Workflow
• Validation
• Pitfalls

This ensures the agent understands the boundaries of a technique rather than applying it blindly.

---

🔄 A Worked Example: From Sample to Detection

The power of a depth-first library lies in chaining. The output of one skill becomes the input for the next, creating a complete analytical loop.

The Analysis Pipeline

The process of triaging a suspicious executable can be represented as a sequence of operations: $\text{Sample} \rightarrow \sum_{i=1}^{8} \text{Skill}_i \rightarrow \text{Durable Detection}$

Execution Steps

CLI Implementation: The mechanical execution is handled via the CLI:

# 1. Recover the beacon config (Read-only)
python tools/analyst-pack.py run triaging-an-unknown-sample -- triage suspicious.exe
python tools/analyst-pack.py run extracting-cobalt-strike-beacon-config -- parse beacon.bin

# 7. Emit a Sigma rule
python tools/analyst-pack.py run hunting-cobalt-strike-traffic -- hunt http.csv

Because every script outputs structured, defanged JSON, the data flows seamlessly from the initial triage into a report or a SIEM.

---

🚀 How to Use It

The entire library is managed through a single entry point: the analyst-pack CLI.

CLI Commands

• Browse skills: python tools/analyst-pack.py list --subdomain threat-hunting
• Search: python tools/analyst-pack.py search kerberos
• Inspect: python tools/analyst-pack.py show hunting-lolbin-abuse-on-windows
• Execute: python tools/analyst-pack.py run identifying-cryptographic-routines-in-binaries -- scan a.bin

Integration with GitHub Copilot

Integration is even more streamlined in VS Code. Once the repository is open, Copilot Chat reads copilot-instructions.md and understands how to utilize the skills safely.

Example Agent Prompts:

• "Hunt for LOLBin abuse in events.csv" $\rightarrow$ triggers hunting-lolbin-abuse-on-windows
• "Triage this unknown file and pull IOCs" $\rightarrow$ chains triage into IOC extraction
• Or, reference a specific file: #file:skills/extracting-cobalt-strike-beacon-config/SKILL.md Use this skill to analyze beacon.bin

Getting Started

Since the scripts are plain Python, no specialized environment beyond your agent is required. To begin:

• Clone the repository
• Point your AI agent to the local folder
• Start analyzing

git clone https://github.com/[username]/AnalystAIPack.git