malware-analysis

SUSPICIOUS: The skill is internally consistent as a malware-analysis guide and does not show obvious credential theft, hidden exfiltration, or suspicious installer provenance. However, it gives an AI agent high-risk offensive/security tooling guidance for analyzing untrusted malware samples, including dynamic execution and anti-analysis techniques, so the operational security risk is high even though malicious intent is not confirmed.

This fragment is best characterized as an anti-analysis/sandbox-evasion guidance module rather than normal library functionality. It enumerates multiple environment fingerprinting and analysis-detection techniques (VM/firmware/hardware/process/window/registry/device artifacts) and includes example logic demonstrating behavioral suppression (e.g., terminating execution when time acceleration or analysis indicators are detected). No direct evidence of malware payload actions (network exfiltration, persistence, or system modification) is present in the fragment, but the actionable evasion mechanics and decision-to-stop pattern present a significant supply-chain risk and warrant reviewing the actual package’s executable code paths, install scripts, and runtime behavior to confirm whether these techniques are used maliciously.