Guide · Agent skill
How to use the Heap Spray Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to use the analyzing-heap-spray-exploitation agent skill, which teaches an AI agent to examine a memory dump for heap spraying, a technique that fills a program's memory with malicious code so an exploit can reliably land on it. It is written for incident responders, SOC analysts, students of memory forensics and threat hunting teams. By the end you will know how to install the skill, ask for the analysis in plain language and read the output it produces.
Heap Spray Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip the skill. Unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder.
- 3Or upload it in the apps. In the Claude apps, open Settings → Capabilities → Skills and upload the ZIP.
- 4Check the requirements. Confirm Python 3.9+, that the vol command runs, and that you have a .raw, .vmem or .dmp dump.
- 5Ask in plain language. Describe the analysis and give the dump path, for example asking for heap spray indicators in a named file.
- 6Review the JSON report. Check the flagged processes, NOP sled locations and shellcode hashes yourself before drawing conclusions.
What the skill makes the agent do
Agent skills are instruction packages that an AI agent loads when a task matches them. This skill covers one narrow job: finding heap spray artifacts in an existing memory dump file, using the Volatility3 framework.
The agent follows a set procedure. It looks for processes with suspicious executable memory regions (using malfind), reviews large contiguous allocations with read-write-execute permissions (using vadinfo), scans suspicious regions for NOP sled byte patterns such as 0x90 and 0x0c0c0c0c, and extracts candidate shellcode so its hashes can be reviewed.
- Processes with injected executable memory regions
- Large allocations with RWX permissions
- NOP sled patterns and their locations
- Extracted shellcode candidates and their hashes
Install the skill from a ZIP file
Download the ZIP for this skill from this page and unzip it. To make it available to all your projects, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Install the requirements
The skill needs Python 3.9 or newer, the Volatility3 framework, which the agent invokes through the 'vol' command, and a memory dump file in .raw, .vmem or .dmp format. The source does not give installation instructions for Volatility3, so follow its own documentation for that step.
Before asking for an analysis, confirm that the vol command runs on your machine and that your dump file is in one of the supported formats.
- Python 3.9+
- Volatility3 framework, invoked as 'vol'
- A memory dump: .raw, .vmem or .dmp
Trigger the skill with natural requests
You do not need to name the skill. Describe the task in plain words that mention heap spraying, memory dumps or the Volatility3 plugins involved, and the agent will match the request to this skill. Include the path to your dump file so the agent knows what to analyze.
The skill's reference file lists the plugin commands the agent uses. For example, the malfind plugin is run as vol -f dump.raw windows.malfind, and the memmap plugin with --pid and --dump dumps a process's memory to files.
- Look for heap spray indicators in ./incident/memory.raw using Volatility3.
- Check this .vmem capture for NOP sleds and large RWX allocations.
- Find processes with injected executable memory in dump.raw and summarise what you find.
- Extract the suspicious regions for process 1234 and hash any shellcode candidates.
Read the output
The skill's expected output is a JSON report. It contains suspicious processes, heap spray indicators, NOP sled locations, memory region sizes and extracted shellcode hashes. Review each entry yourself, because the report flags candidates for analysis rather than confirming an attack.
Safety notes: scripts and network
This skill runs scripts. Its bundled script, scripts/agent.py, automates parts of the procedure by running Volatility3 and writing a JSON report. The skill does not use the network. Read the script before running it on a sensitive dump, and only analyze memory from systems you are authorized to investigate, since the script is labelled for authorized forensic analysis only.
The skill works only on existing dump files. It does not work on live systems and contains no remediation steps.
- Runs scripts: yes (scripts/agent.py)
- Uses network: no
- Only analyze dumps from systems you are authorized to investigate
Tips for better results
Give the agent the exact dump path and the operating system if you know it, since the plugins shown are Windows plugins. Ask for the JSON report explicitly if you want a structured result. Keep an untouched copy of the original dump so you can repeat the analysis.
- Name the dump file and its format in your request
- Specify the process ID when you already have one
- Ask for shellcode hashes in the report if you plan to compare them with other captures
What people use it for
- Triaging a memory capture from a machine where an exploit was suspected.
- Checking a dump for large RWX allocations and NOP sled patterns during an incident.
- Teaching memory forensics students what heap spray artifacts look like in a dump.
- Building threat hunting or detection procedures around memory-based exploits.
Frequently asked questions
Is the Heap Spray Analysis skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the licence file in the ZIP for the full terms. Volatility3 is a separate framework that you install yourself.
What do I need to run this skill?
You need Python 3.9 or newer, the Volatility3 framework invoked through the vol command, and a memory dump file in .raw, .vmem or .dmp format. The skill does not use the network.
Where do I install the skill folder?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
Can this skill analyze a live computer?
No. It only works on existing memory dump files. It does not contain remediation steps, so it is not a tool for removing malware.
Why does the agent not use my request to start the skill?
Mention heap spraying, memory dumps or Volatility3 and include the path to your dump file. Plain requests about the skill's topic are what the agent matches to it.
How does this compare with running Volatility3 plugins by hand?
The skill follows a fixed procedure and runs parts of it through a bundled script that writes a JSON report. Running the plugins yourself gives you direct control over each step. The source does not compare the two in terms of speed or accuracy.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an incident responder, SOC analyst, student or threat hunter who already has Volatility3 and a memory dump and wants a structured heap spray check. Pick something else if you need to analyze live systems, remove malware or investigate a machine you are not authorised to examine.
Download the skill