# Analyze Suspicious Script Or Document

> Decode and analyze suspicious scripts and active documents without triggering them. Use for shell, AppleScript, JavaScript, Python, PowerShell, shortcuts, Office files, PDFs, profiles, macros, embedded objects, and staged payloads.

- Skill: `gaelic-ghost/analyze-suspicious-script-or-document` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/analyze-suspicious-script-or-document`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/analyze-suspicious-script-or-document/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/analyze-suspicious-script-or-document

---


# Analyze Suspicious Script Or Document

## Overview

Recover the execution chain as data. Use parsers and text extraction in isolation, avoid native handlers, and make each decoding transformation reproducible.

Read [references/script-document-analysis.md](references/script-document-analysis.md) for language and document-specific checks.

## Workflow

1. Preserve the original and identify the real container/type.
2. Extract without activation.
   - List document members and relationships; extract text, metadata, macros, JavaScript, forms, links, embedded files, and external references with non-executing tooling.
   - Render URLs and commands as inert text.
3. Normalize one layer at a time.
   - Decode base64/hex/URL escapes, string concatenation, compression, character arithmetic, environment substitution, and generated commands.
   - Record input, operation, tool, and output hash for every layer.
4. Reconstruct control and data flow.
   - Identify entry conditions, interpreter, downloaded content, execution methods, persistence, credential/file access, network destinations, cleanup, and environment gates.
5. Separate capability from execution.
   - State which branches are present, which inputs activate them, and which behaviors remain inferred.
6. Route payloads.
   - Send recovered binaries to static/reverse analysis and use dynamic analysis only inside chosen isolation.

## Guardrails

- Do not paste decoded commands into an executing shell.
- Do not enable macros, install profiles, follow links, or import shortcuts during static analysis.
- Do not use a cloud document parser for private content without approval.

## Output

Return container identity, recovered layers, execution chain, indicators, activation conditions, likely impact, uncertainty, and safe next step.