zhaoxuya520Install Competition Malware Config
Pick your agent. Every command is ready to paste.
npx skills add zhaoxuya520/reverse-skill --skill competition-malware-configThe open skills CLI detects your agents (Claude Code, Cursor, Codex and 70+ more) and installs to the right folder. Add -g to install globally.
01
Install it
Run the command above, or upload the folder in Claude.
02
Ask naturally
Describe the task. Your agent loads competition-malware-config when the request matches its description.
03
Name it if needed
If it does not trigger, say “use the competition-malware-config skill”. In Codex, type $competition-malware-config.
Competition Malware Config
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original sample before unpacking or patching.
- Separate loader, payload, config blob, and post-decode behavior.
- Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
- Record the exact transform chain for each recovered field.
- Reproduce the decoded config or beacon parameters from the smallest possible path.
Workflow
1. Find The Config Boundary
- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
- Keep one note of when each value becomes plaintext.
2. Reconstruct The Decode Chain
- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
- Group all config fields from the same chain together instead of treating them as unrelated clues.
- Preserve hashes, offsets, keys, IVs, masks, and parsed fields in one compact evidence block.
3. Tie Config To Behavior
- Show which field affects which branch: beacon path, mutex, wallet, bot id, campaign, tasking route, persistence name, or process target.
- Correlate decoded config with PCAPs, process trees, or stage2 strings when possible.
Read This Reference
- Load
references/malware-config.mdfor the config-hunting checklist, staged-sample checklist, and evidence packaging rules.
What To Preserve
- Original artifact, unpacked layer, dumped stage, and parsed config as separate artifacts
- Offsets, hashes, decode helpers, keys, masks, and field names
- The branch or protocol step each recovered field actually influences
Tips for Competition Malware Config
- • Start a fresh session after installing so your agent picks up the new skill.
- • It bundles reference files. The agent reads them only when needed, so they cost no context until then.
- • It is part of a pack with 30 skills. Install only the ones you need with --skill to keep triggers precise.
- • If two skills overlap, mention the one you want by name.
Questions about Competition Malware Config
What does the Competition Malware Config skill do?
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ct
How do I install Competition Malware Config?
Run "npx skills add zhaoxuya520/reverse-skill --skill competition-malware-config" in your project. The skills CLI installs it for Claude Code, Cursor, Codex and 70+ other agents. In Claude on the web, upload the skill folder as a ZIP under Customize > Skills.
Does Competition Malware Config work in Cursor and Codex?
Yes. Competition Malware Config uses the open SKILL.md format, so it works in Claude Code, Claude, Cursor, OpenAI Codex, Gemini CLI, GitHub Copilot and other agents that support agent skills.
Is Competition Malware Config free?
Competition Malware Config is open source on GitHub under the MIT license. It is free to install; check the license before commercial use.
Who made Competition Malware Config?
Competition Malware Config is published by zhaoxuya520 in the zhaoxuya520/reverse-skill repository, together with 29 other skills.
