The Security Starter Pack
3 advanced information security skills for the price of 2. Get this pack and start triaging threats in your network today!
Works with every agent that reads SKILL.md — Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, Windsurf, OpenClaw, and more.
One payment, lifetime access. 3 skills unlock instantly in your library.
What's included
3 skills
Safely triage suspicious files and scripts using static analysis, MITRE ATT&CK mapping, and heuristic scoring.
Detect C2 beacons, DNS tunneling, and data exfiltration by scoring network telemetry for regularity and entropy.
Automated phishing triage and header analysis for SOC teams to detect spoofing and malicious email indicators.
See it in action
File Static Triage
Example session with this skill installed
Analyze this triage report for a suspicious file named 'invoice_copy.exe' that was flagged by a user. It has high entropy and imports VirtualAllocEx and WriteProcessMemory.
- Read your context and instructions
- Compiled the file static triage
The file invoice_copy.exe is classified as High Suspicion (Score: 75) due to indicative patterns of process injection and packing.
Triage Report: invoice_copy.exe
| Metric | Value |
|---|---|
| Verdict | High Suspicion (Score: 75) |
| SHA256 | 85c3275965106658444ed305c6d542c830157053361039f60c45fe70b135b927 |
| File Type | Win32 EXE (PE32) |
| Entropy | 7.85 (Likely Packed/Encrypted) |
| Compile Time | 2023-11-12 04:15:22 |
Detected Behaviors & ATT&CK Mapping
Process Injection (T1055): Combined use of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread indicates intent to inject code into a remote process.
Obfuscated Files or Information (T1027): High entropy in the .text section suggests the presence of a packer or encrypted payload.
- Suspicious Imports: Usage of
IsDebuggerPresentandCheckRemoteDebuggerPresentfor anti-analysis evasion.
Summary
The sample displays classic downloader/injector behavior. The high entropy combined with memory manipulation APIs suggests a packed malicious payload designed to bypass basic static signatures.
Next steps
- Search the environment for the SHA256 hash in EDR logs to identify other infected hosts.
- Perform dynamic analysis in a sandbox to capture the secondary payload URL.
- Create a YARA rule targeting the specific import pattern and high-entropy section.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs these skills for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every skill in this bundle passes our trust checks.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back