Skip to content
Get packs

Malicious PDF Static Analysis

Guides static triage of suspicious PDFs using peepdf, pdfid and pdf-parser to surface embedded JavaScript and exploit indicators.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a structured workflow for examining a suspicious PDF file without opening it normally: it scans for risky keywords such as automatic-open actions, embedded JavaScript and embedded files, dumps and decodes suspicious objects, and produces a structured report with hashes, extracted URLs, a shellcode yes/no finding and a risk rating. It also includes a Python helper script that computes file hashes and runs the pdfid tool to tally keywords.

Great for

  • Security analysts triaging PDF attachments reported from phishing emails
  • Malware analysts and DFIR staff documenting weaponized document samples
  • Students learning how PDF-based exploits are structured

Skip it if

  • Casual users who simply want to know whether a PDF is safe; the analysis requires specialist tools and interpretation, and a clean result does not prove safety
  • Analysing live malware on a normal workstation; the skill itself says to use an isolated VM or sandbox, and skipping this risks infection

Try asking

  • “Triage this suspicious invoice PDF from a phishing email and list the risky keywords it contains”
  • “Find any embedded JavaScript and OpenAction triggers in sample.pdf and summarise them”
  • “Generate a PDF malware analysis report with hashes, extracted URLs and a risk level”
Step-by-step guide: how to use Malicious PDF Static AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-malicious-pdf-with-peepdf.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-malicious-pdf-with-peepdf.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-malicious-pdf-with-peepdf.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run this only inside an isolated VM or sandbox with networking restricted, since the helper script executes external analysis tools on the sample
  • Treat the agent's risk rating as a starting point and verify important findings manually, because the skill is static and does not confirm malicious behaviour
  • Check that the VirusTotal step is intended before running it, since it may send file hashes to a third-party service

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.