How do I install the Malware Check skill?

Run npx skillmds@latest add tomevault-io/malware-check in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Malware Check safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Malware Check?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Malware Check free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Malware Check?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Malware Check by tomevault-io — Agent Skill

Name: Malware Check
Author: tomevault-io

Malware Check

Analyze code, binaries (.exe, .app, .dll, .apk, .ipa), and projects for malicious patterns, backdoors, reverse shells, crypto miners, ransomware, supply chain attacks, and privacy violations. Use this skill whenever the user asks to check if code is malicious, scan a binary for malware, verify an app is safe, audit code security, detect obfuscated payloads, analyze a suspicious file, or review a project for backdoors. Also use when the user mentions "is this safe", "check for malware", "scan this binary", "is this app malicious", "security scan", or "malware analysis". Use when this capability is needed.

tomevault-io a7d65f6 2 files · 4.9 KB Updated Sep 17, 2026

File contents

malware-check

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.

Prerequisites

Ensure malware-check is installed:

pip install malware-check

For full capabilities:

pip install malware-check pefile lief yara-python

Verify with: malware-check info

If not installed, install it before proceeding.

What It Detects

Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
Crypto miners (stratum pools, mining APIs, wallet addresses)
Ransomware (file encryption walks, ransom messages)
Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
Supply chain attacks (malicious install hooks, dependency confusion)
Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
Keyloggers (keyboard hooks across platforms)
Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
Unsafe deserialization, template injection (SSTI)

Usage

Scan source code or project directory

malware-check scan <path> --verbose

Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)

malware-check scan <binary-path> --verbose

Scan with Docker behavioral analysis

# Build sandbox first (one-time)
malware-check build-sandbox

# Run with dynamic analysis
malware-check scan <binary-path> --dynamic --verbose

Scan mobile apps (.apk, .ipa)

malware-check scan app.apk --mobile --verbose

Generate reports

# JSON
malware-check scan <path> --format json -o report.json

# HTML dashboard
malware-check scan <path> --format html -o report.html

# SARIF (for CI/CD)
malware-check scan <path> --format sarif -o report.sarif

Workflow

Run malware-check scan <target> --verbose first to get an overview
If findings are detected, run malware-check scan <target> --format html -o report.html for a detailed HTML report
For binaries, add --dynamic for behavioral analysis in Docker sandbox
For mobile apps, add --mobile for MobSF analysis
Present findings to the user organized by severity (Critical > High > Medium > Low)
For each finding, include: severity, category, file path, line number, evidence, and recommendation
Use the SARIF format (--format sarif) when integrating with CI/CD pipelines

Custom YARA Rules

Point to a custom rules directory:

malware-check scan <path> --yara-rules /path/to/rules/

Investigation Tools

When deeper analysis is needed beyond what malware-check provides, refer to docs/INVESTIGATION_TOOLS.md for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).

Key CLI Options

Flag	Purpose
`--verbose` / `-v`	Show detailed findings with evidence
`--format` / `-f`	Output: console, json, html, sarif
`-o` / `--output`	Output file path
`--dynamic`	Enable Docker sandbox behavioral analysis
`--mobile`	Enable MobSF mobile analysis
`--yara-rules`	Custom YARA rules directory
`--exit-code`	Non-zero exit on findings (for CI)
`--no-privacy`	Disable privacy analysis

Source: momenbasel/malware-check — distributed by TomeVault.

---name: malware-checkdescription: Analyze code, binaries (.exe, .app, .dll, .apk, .ipa), and projects for malicious patterns, backdoors, reverse shells, crypto miners, ransomware, supply chain attacks, and privacy violations. Use this skill whenever the user asks to check if code is malicious, scan a binary for malware, verify an app is safe, audit code security, detect obfuscated payloads, analyze a suspicious file, or review a project for backdoors. Also use when the user mentions "is this safe", "check for malware", "scan this binary", "is this app malicious", "security scan", or "malware analysis". Use when this capability is needed.---# malware-checkStatic and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.## PrerequisitesEnsure `malware-check` is installed:```bashpip install malware-check```For full capabilities:```bashpip install malware-check pefile lief yara-python```Verify with: `malware-check info`If not installed, install it before proceeding.## What It Detects- Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)- Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)- Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)- Crypto miners (stratum pools, mining APIs, wallet addresses)- Ransomware (file encryption walks, ransom messages)- Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)- Supply chain attacks (malicious install hooks, dependency confusion)- Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)- Keyloggers (keyboard hooks across platforms)- Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)- Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)- Unsafe deserialization, template injection (SSTI)## Usage### Scan source code or project directory```bashmalware-check scan <path> --verbose```### Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)```bashmalware-check scan <binary-path> --verbose```### Scan with Docker behavioral analysis```bash# Build sandbox first (one-time)malware-check build-sandbox# Run with dynamic analysismalware-check scan <binary-path> --dynamic --verbose```### Scan mobile apps (.apk, .ipa)```bashmalware-check scan app.apk --mobile --verbose```### Generate reports```bash# JSONmalware-check scan <path> --format json -o report.json# HTML dashboardmalware-check scan <path> --format html -o report.html# SARIF (for CI/CD)malware-check scan <path> --format sarif -o report.sarif```## Workflow1. Run `malware-check scan <target> --verbose` first to get an overview2. If findings are detected, run `malware-check scan <target> --format html -o report.html` for a detailed HTML report3. For binaries, add `--dynamic` for behavioral analysis in Docker sandbox4. For mobile apps, add `--mobile` for MobSF analysis5. Present findings to the user organized by severity (Critical > High > Medium > Low)6. For each finding, include: severity, category, file path, line number, evidence, and recommendation7. Use the SARIF format (`--format sarif`) when integrating with CI/CD pipelines## Custom YARA RulesPoint to a custom rules directory:```bashmalware-check scan <path> --yara-rules /path/to/rules/```## Investigation ToolsWhen deeper analysis is needed beyond what malware-check provides, refer to `docs/INVESTIGATION_TOOLS.md` for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).## Key CLI Options| Flag | Purpose ||---|---|| `--verbose` / `-v` | Show detailed findings with evidence || `--format` / `-f` | Output: console, json, html, sarif || `-o` / `--output` | Output file path || `--dynamic` | Enable Docker sandbox behavioral analysis || `--mobile` | Enable MobSF mobile analysis || `--yara-rules` | Custom YARA rules directory || `--exit-code` | Non-zero exit on findings (for CI) || `--no-privacy` | Disable privacy analysis |---> Source: [momenbasel/malware-check](https://github.com/momenbasel/malware-check) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions