Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-malicious-pdf-with-peepdfCompatible with
Supported agents
| name | analyzing-malicious-pdf-with-peepdf |
| description | Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | - malware-analysis - pdf - peepdf - pdfid - pdf-parser - static-analysis - reverse-engineering - dfir |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | - DE.AE-02 - RS.AN-03 - ID.RA-01 - DE.CM-01 |
| Concept | Description |
|---|---|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |
| Tool | Purpose |
|---|---|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionanalyzing-malicious-pdf-with-peepdfExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-malicious-pdf-with-peepdfFetches analyzing-malicious-pdf-with-peepdf from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/analyzing-malicious-pdf-with-peepdf
Restart Cursor to activate analyzing-malicious-pdf-with-peepdf. Access via /analyzing-malicious-pdf-with-peepdfin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
performing-initial-access-with-evilginx3
mukul975/Anthropic-Cybersecurity-Skills · performing-initial-access-with-evilginx3 · same repo
performing-cryptographic-audit-of-application
mukul975/Anthropic-Cybersecurity-Skills · performing-cryptographic-audit-of-application · same repo
implementing-soar-automation-with-phantom
mukul975/Anthropic-Cybersecurity-Skills · implementing-soar-automation-with-phantom · same repo
correlating-security-events-in-qradar
mukul975/Anthropic-Cybersecurity-Skills · correlating-security-events-in-qradar · same repo
configuring-hsm-for-key-storage
mukul975/Anthropic-Cybersecurity-Skills · configuring-hsm-for-key-storage · same repo
exploiting-api-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · exploiting-api-injection-vulnerabilities · same repo
analyzing-malicious-pdf-with-peepdf is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Keeps context tight: analyzing-malicious-pdf-with-peepdf is the kind of skill you can hand to a new teammate without a long onboarding doc.
Solid pick for teams standardizing on skills: analyzing-malicious-pdf-with-peepdf is focused, and the summary matches what you get after install.
Keeps context tight: analyzing-malicious-pdf-with-peepdf is the kind of skill you can hand to a new teammate without a long onboarding doc.
analyzing-malicious-pdf-with-peepdf fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
analyzing-malicious-pdf-with-peepdf has been reliable in day-to-day use. Documentation quality is above average for community skills.
analyzing-malicious-pdf-with-peepdf fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
I recommend analyzing-malicious-pdf-with-peepdf for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
analyzing-malicious-pdf-with-peepdf has been reliable in day-to-day use. Documentation quality is above average for community skills.
Keeps context tight: analyzing-malicious-pdf-with-peepdf is the kind of skill you can hand to a new teammate without a long onboarding doc.
showing 1-10 of 39