meltedinhex/analyst-ai-pack

AnalystAIPack is a library of 118 ready-made skills designed to give an AI agent the working knowledge of a security analyst. The skills cover four tightly focused areas: malware analysis, reverse engineering, threat hunting, and shared lab foundations. Each skill is a structured procedure file paired with a runnable Python script that performs actual analysis rather than just written instructions. The library is designed to be used with AI coding assistants and agents such as GitHub Copilot, Claude Code, Cursor, or anything that follows the agentskills.io format. You clone the repository, point your agent at the skills directory, and the agent can then chain skills together to run multi-step analysis workflows. A worked example in the README shows how to take a suspicious executable from initial triage through static analysis, unpacking, config extraction, IOC handling, network traffic hunting, and writing a detection rule, all by chaining skills in sequence. Every Python script uses only the standard library where possible, with optional dependencies that degrade gracefully when missing. Scripts perform read-only static analysis and never execute the sample being analyzed. Output is structured JSON with indicators of compromise defanged (rendered in a format that prevents accidental interaction with malicious addresses). Each skill follows a consistent structure with sections for when to use it, when not to use it, the workflow, validation steps, and known pitfalls. The skills are mapped to three MITRE frameworks: ATT&CK for attacker techniques, D3FEND for defensive countermeasures, and CAR for detection analytics. This lets you look up which skills cover a particular ATT&CK technique or find defensive coverage gaps in your environment. The library is aimed at SOC analysts triaging unknown files, malware analysts extracting configurations from packed samples, threat hunters writing Sigma and YARA detection rules, and developers building security-focused AI agents. It is Apache 2.0 licensed with a CI pipeline that smoke-tests every script.