← All skills
Skill
analyzing-indicators-of-compromise
skill:mukul975/anthropic-cybersecurity-skills#analyzing-indicators-of-compromise
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
Verdict
Inconclusive
The analysis could not cover enough of the artifact to decide.
0
findings
—
highest severity
0
threat classes
4,532
files scanned
109/109
checks satisfied
0
package advisories
Why this verdict
- inconclusive: unresolved question on EXEC
- inconclusive: unresolved question on EXFIL
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions below.
Open questions 2
What the analysis could not settle from the code alone.
Detector leads place requests.get/post calls in scripts/agent.py lines 70-126 (inside unit SRC:66a8c84c34f4bbdf's line span) to VirusTotal, AbuseIPDB, and MalwareBazaar with env-read API keys, but the shown decoded text of that unit contains only function docstrings; whether these calls transmit only the IOC under analysis plus the service key to the declared endpoints cannot be confirmed from the shown text.
Data exfiltration
Detector leads show the string 'http://malicious-site.com/payload.exe' at scripts/agent.py line 227 (outside the shown docstring text); whether it is a static sample/test IOC fixture or a URL fetched or executed at runtime cannot be determined from the shown text.
Code execution