analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,…
Testing what is locked and what isn’t
What it does
- A system shows signs of compromise that persist through OS reinstallation - Antivirus and EDR are unable to detect malware despite clear evidence of compromise - UEFI Secure Boot has been disabled or shows integrity violations - Memory forensics reveals rootkit behavior (hidden processes, hooked system calls) -
Read more
Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)
Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs
You don’t need to name it. Ask for the job in your own words — your AI loads the skill when the request matches.
What it can touch
Includes 1 script
Your AI can run these when the skill is used — on your computer in a coding tool (which asks first unless you have told it not to), or in the AI’s own sandbox in Claude and ChatGPT.
How we know
Found in the skill’s folder: scripts/agent.py.
Uses terminal commands
It shows your AI commands to run. In a coding agent that means your terminal; in a chat app it usually can’t.
How we know
The SKILL.md contains shell code blocks.
No known risk pattern found
Launch7’s automated check read all 4 text files in this skill and matched none of its risk patterns. This is not a guarantee: a check like this can miss new or disguised tricks, and the author can change the files after the check.
How we know
Read 2026-10-05, commit 54a7988 by pipeline/trust/analyze.py — 40+ patterns for hidden text, prompt injection, downloads that run, credential access and more. It reads; it never runs the skill.
Recently maintained
Its repository has had changes recently.
How we know
Last push to mukul975/Anthropic-Cybersecurity-Skills: 2026-08-31 (35 days before the scan).
Read automatically from the skill’s own files on GitHub on 5 Oct 2026. Launch7 does not run or manually review skills: this lists what the check saw, and nothing here means “safe”. How we check
Add it to your AI
Partly. Upload it in Claude’s settings — the instructions work; the scripts need the full folder.
Built in your browser from the SKILL.md on GitHub — nothing passes through Launch7.
In Claude, open Customize → Skills, press +, then Create skill → Upload a skill, and choose the .zip.
Make sure code execution is switched on (Settings → Capabilities). Skills need it.
Start a new chat and ask for the job in your own words — Claude picks the skill up when it fits.
This skill ships 1 script beside its instructions. The download here is the SKILL.md alone — enough for the instructions, not for the parts that run code. Use the command route, or take the full folder from the repository.
How Claude does this: support.claude.com · checked 28 Sep 2026 · “Supported” means documented by the vendor; Launch7 has not run it end to end
More from mukul975
All from this publisher →- abusing-dpapi-for-credential-access
After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.
- abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or…
- achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements…
- acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash…
- analyzing-apt-group-with-mitre-navigator
When investigating security incidents that require analyzing apt group with mitre navigator - When building detection rules or threat…
