{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-malici-4e49e7",
  "kind": "skill",
  "name": "analyzing-malicious-pdf-with-peepdf",
  "description": "Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "malware-analysis",
      "pdf",
      "peepdf",
      "pdfid",
      "pdf-parser",
      "static-analysis",
      "reverse-engineering",
      "dfir",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-malicious-pdf-with-peepdf/SKILL.md",
      "ref": "HEAD",
      "url": "https://www.skills.sh/mukul975/anthropic-cybersecurity-skills/analyzing-malicious-pdf-with-peepdf",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Malicious PDF with peepdf\n\n## When to Use\n\n- When triaging suspicious PDF attachments from phishing emails\n- During malware analysis of PDF-based exploit documents\n- When extracting embedded JavaScript, shellcode, or executables from PDFs\n- For forensic examination of weaponized document artifacts\n- When building detection signatures for PDF-based threats\n\n## Prerequisites\n\n- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)\n- pdfid.py and pdf-parser.py from Didier Stevens suite\n- Isolated analysis environment (VM or sandbox)\n- Optional: PyV8 for JavaScript emulation withi",
  "cost": {
    "context_tokens": 620
  }
}