Guide · Agent skill
How to use the Ransomware Decoy File Deployer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Ransomware Decoy File Deployer is an agent skill (skill name: deploying-decoy-files-for-ransomware-detection) that teaches an AI agent to place canary files, also called honeytokens, across file shares and endpoints. If anything modifies, renames or deletes one of these decoys, the agent flags a likely ransomware event so a security team can respond. This guide explains what the skill does, how to install it, how to trigger it, and what to check before using it.
Ransomware Decoy File Deployermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page. It contains SKILL.md, scripts/agent.py and references/api-reference.md.
- 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project.
- 3Install Python dependencies. Install Python 3.8+ and run pip install watchdog. Add python-docx if you want .docx canaries.
- 4Check access and scope. Confirm you have administrative access to the target shares or endpoints and that you know which directories are high value.
- 5Ask the agent for a deployment. Describe the environment and the outcome you want, such as canaries on a finance share with alerts to your SOC.
- 6Test with controlled changes. Modify or rename a canary in a test location and confirm the alert reaches your SIEM or alerting system.
- 7Enable responses carefully. Turn on automated responses only after admin review and successful alert testing.
What is an agent skill?
An agent skill is a folder of instructions and optional scripts that an AI agent loads when a task matches the skill's description. The agent reads SKILL.md to learn the workflow, and can use the bundled files when it needs them.
What the skill makes the agent do
The skill walks the agent through five steps: designing a canary placement strategy, generating realistic decoy documents, deploying a file system watcher, configuring alert responses, and validating detection coverage.
Canary files are placed in locations such as the root of file shares, desktops, Documents and Downloads folders, and finance, HR or legal directories. Decoys use file types ransomware often targets, such as .docx, .xlsx, .pdf, .sql and .bak. The watcher uses the watchdog Python library to report modifications, deletions and renames. The bundled scripts/agent.py helper generates and monitors canary files, uses SHA-256 hashes to detect changes, and checks activity against a list of known ransomware file extensions and ransom note names.
- Canary placement strategy with naming that sorts first and last alphabetically
- Realistic .docx and text canary generation
- File system watcher for MODIFIED, DELETED and RENAMED events
- Severity-based alert response matrix
- Validation tests that simulate encryption and renaming safely
Install the skill
Option 1: Download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/, so it is available in all your projects.
Option 2: Unzip it into a project's .claude/skills/ folder to limit it to that project.
Option 3: In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- Files included: SKILL.md, scripts/agent.py and references/api-reference.md
Install the requirements
The skill needs Python 3.8 or newer and the watchdog library. If you want the agent to generate .docx canary files, you also need python-docx. The watchdog installation command is shown in the bundled API reference.
- Python 3.8+
- watchdog Python library
- python-docx (for .docx canaries)
- Administrative access to target file shares or endpoints
- Optional but recommended: a FIM tool or SIEM for alert routing
pip install watchdogHow to trigger the skill with natural requests
You do not need to name the skill. The agent loads it when your request matches its description, which covers ransomware canary deployment, honeyfile setup, deception-based ransomware detection and file integrity monitoring for encryption. Be specific about the environment so the agent can choose sensible locations.
- Set up canary files on our finance file share to catch ransomware early
- Write a Python script that places honeyfiles in each user's Documents folder and alerts when they change
- Help me design a canary placement strategy for our HR and legal shares
- Create a test plan to confirm our ransomware alerts fire when a canary is modified
Safety notes: scripts and network access
This skill runs scripts. The source lists scripts as used, but it does not make network calls, so the bundled helper is not described as contacting external services. Review scripts/agent.py before running it.
The script and watcher need elevated access. The skill's own guidance includes automated responses such as killing a process or disabling a network interface. A misconfigured response can disrupt business, so run the deployment with admin review and test it outside production first.
- Read scripts/agent.py before execution
- Test in a non-production environment first
- Exclude backup agents and AV scans from alerts to avoid false positives
- Keep automated responses off until the alert flow is validated
Tips for getting reliable results
Use canary names that sort first and last in each directory, because ransomware often enumerates folders alphabetically. Keep the canary contents fixed so hash baselines stay valid. Run the validation step after every change, and confirm that canaries survive normal backup and restore operations.
- Store hash baselines so you can verify canaries are unmodified
- Expect alerts within the timeframe you set; the skill's verification checks for under 30 seconds
- Map each alert to a severity and an owner in the SOC
What people use it for
- Placing tripwire documents on a finance or HR file share to catch unauthorized encryption
- Generating realistic .docx and text canaries across endpoint Desktop and Documents folders
- Testing whether an existing alerting pipeline fires when a canary is changed
- Designing a canary placement plan that covers file shares, backup staging and high-privilege home directories
Frequently asked questions
How do I install the deploying-decoy-files-for-ransomware-detection skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What does the ransomware decoy file skill require?
It requires Python 3.8 or newer, the watchdog library, and python-docx if you want .docx canaries. You also need administrative access to target file shares or endpoints. A FIM tool or SIEM is optional but recommended for alert routing.
Is the decoy file deployer skill free and open source?
The skill is licensed under Apache-2.0. Check the license file in the download for the full terms.
Can decoy files stop ransomware on their own?
No. The skill describes canary files as a detection mechanism, not a prevention mechanism. They should be used alongside backups, EDR and access controls.
Does this skill make network calls?
The source states that the skill does not use the network, but it does run scripts. Review scripts/agent.py before running it.
What should I do if my canary alerts keep firing on normal activity?
Exclude legitimate processes such as backup agents and AV scans from alerts, as the skill's verification guidance recommends. Also confirm that canary files are not being touched by users or routine tools.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security or IT teams that want a low-false-positive early-warning layer on file servers or endpoints, and teams that need to test their ransomware alerting. It is not a standalone defense, and it should not be deployed unsupervised on production systems because its scripts need elevated access and can trigger automated responses. If you need prevention or full endpoint protection, pair it with backups, EDR and access controls, or look at dedicated EDR products.
Download the skill