Guide · Agent skill
How to use the Ransomware Encryption Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Ransomware Encryption Analyzer is an agent skill, a folder of instructions and helper scripts that an AI agent such as Claude loads when your request matches its topic. This guide explains what the analyzing-ransomware-encryption-mechanisms skill makes the agent do, how to install it, how to phrase requests so it activates, and what it needs and where it is risky. It is aimed at incident responders, malware analysts and security students who want to judge whether an encrypted system can be recovered without paying.
Ransomware Encryption Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip the analyzing-ransomware-encryption-mechanisms folder.
- 2Place the folder. Move it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install Python libraries. Make sure Python 3.8 or newer is available, then install the pefile and pycryptodome libraries used by the examples.
- 4Prepare an isolated lab. Copy the sample and encrypted files to an analysis system that is not connected to your live network, and keep untouched originals.
- 5Ask a specific question. Describe the ransomware situation, the files involved and your goal, such as identifying the algorithm or checking for key reuse.
- 6Verify on test copies. Test any proposed decryption method on copies of encrypted files before applying it to anything important.
What the skill makes the agent do
The skill gives the agent a structured method for examining a ransomware sample and its encrypted files. It covers identifying the encryption algorithm (the source names AES, RSA, ChaCha20 and hybrid schemes), examining how keys are generated and stored, and checking for implementation mistakes that could allow recovery without paying the attacker.
It also includes a Python helper, scripts/agent.py, which the source describes as computing file hashes, measuring entropy and searching for cryptographic constants in a binary.
- Identify the algorithm by checking Windows Crypto API and CNG imports in a PE file with pefile
- Classify key management as strong, weak or flawed, based on the patterns listed in the skill
- Test encrypted files for key reuse, predictable key derivation and ECB mode
- Check whether a known free decryptor from NoMoreRansom.org might apply
Install the skill from ZIP or the Claude apps
Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill under Settings → Capabilities → Skills rather than copying files manually.
The skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. Keep that structure intact so the agent can find the instructions and helper.
~/.claude/skills/analyzing-ransomware-encryption-mechanisms/Install the required libraries
The skill itself does not install software. Before using the examples you need Python 3.8 or newer, the pefile library (used in the examples) and the pycryptodome library. Ghidra or IDA Pro is needed for reverse engineering and is a separate manual install.
- Python 3.8+
- pefile library
- pycryptodome library
- Ghidra or IDA Pro (manual install, not included)
Trigger the skill with natural requests
You do not need a special command. The skill's description says it activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment or ransomware decryption feasibility, so describe your goal in those terms and include the relevant details.
Good requests name the situation, the files and what you want to learn. Give the agent the sample path or encrypted file details it needs, and say whether you are assessing recovery or studying the technique.
- "A ransomware sample is in ./sample/ and encrypted files are in ./data/. Identify the encryption algorithm and tell me whether decryption looks feasible."
- "Check these two encrypted files for key or IV reuse, and test for ECB mode."
- "Assess whether a NoMoreRansom.org decryptor could apply to this ransomware family."
- "Explain how key management in this sample could be weak, step by step, for a training write-up."
What to expect when you run it
The workflow runs in steps: identify the algorithm, analyze key generation and storage, examine the file encryption routine, test for weaknesses, then attempt key recovery. The skill's examples use pefile to list crypto-related imports and pycryptodome to test decryption against known-plaintext pairs.
The source shows the sample scheme table, for example that AES-128-ECB is a weak mode where decryption may be possible via known-plaintext, and that XOR-only encryption is trivial. Treat these as starting hypotheses to verify, not conclusions.
Safety notes: scripts, live machines and test copies
This skill runs scripts (scripts/agent.py and example Python code) and it does not use the network, according to its listing. Even so, the skill tells you to verify any decryption method on test copies of encrypted files first, because a wrong attempt can permanently damage data.
Do not run Ghidra or decompiled code on live infected machines, since that can spread the infection. Work on isolated analysis systems with copies of the samples. The skill is not for breaking encryption on systems you do not own or have authority to test.
- Always test decryption on copies, never on the only copy of your files
- Do not analyze live infected systems; use an isolated lab
- The skill does not install Ghidra, IDA Pro or other tools for you
- Review scripts/agent.py before running it, as you would any script
What people use it for
- Assessing whether a ransomware-encrypted system can be recovered without paying the attacker
- Identifying the encryption algorithm and key handling of a sample for an incident report
- Checking whether a known free decryptor from NoMoreRansom.org could apply to a case
- Teaching how ransomware cryptography is reverse engineered in a security course
Frequently asked questions
How do I install the ransomware encryption analyzer skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run it?
The source lists Python 3.8+, the pefile library (used in the examples), the pycryptodome library, Ghidra or IDA Pro for reverse engineering, sample encrypted files with known-plaintext pairs, and access to the ransomware binary. Ghidra and IDA Pro are not installed by the skill.
Is the skill free, and what is its licence?
The skill is listed under the Apache-2.0 licence. The source does not state any price, so check the repository for licence terms before reuse.
Does the skill use the internet?
No. The listing says it does not use the network, although it does run scripts, so review scripts/agent.py before running it.
Can it guarantee I can recover my files?
No. The skill assesses feasibility and checks for weaknesses such as key reuse or ECB mode, but recovery depends on the specific sample and implementation. Always verify any method on test copies first.
How does it compare with using a NoMoreRansom.org decryptor directly?
The skill is meant to help you check whether a known free decryptor from NoMoreRansom.org could apply to your case, as one part of a wider analysis. It does not replace the decryptor database; it helps you reason about the sample's encryption.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits incident responders, malware analysts and security students who can work in an isolated lab and are comfortable with Python and reverse engineering tools. If you need routine data restoration, or you lack malware-analysis experience, use a vetted decryptor or your incident response team instead.
Download the skill