القائمة
Use when a task needs Mandiant capa through the local `runCapa` or `capaHelp` MCP tools, especially when forming a valid capa command string, choosing output mode, or avoiding path-quoting mistakes.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory.
Use when writing, reviewing, or explaining YARA rule syntax, or when preparing `rule_text` for `yaraScanInline` or `yaraWriteRule` so the rule can be saved into the standardized generated-artifact YARA directory.
Use when a task should persist reusable helper files such as Python deobfuscation scripts, Java helpers, reports, or Ghidra-supporting snippets into the standardized agent artifact directory tree.
Use when the task requires emitting a patched binary copy through the local MCP tool lane, especially for short instruction patches or explicit byte replacements.
Use when a task would benefit from a secondary model call through the local MCP tool lane, especially for Hugging Face or OpenAI-compatible inference, decompilation cleanup, classification, or comparing competing interpretations.
Use when a task needs the local `binwalkScan`, `listBinwalkExtraction`, or `binwalkHelp` MCP tools to scan a file for embedded content, optionally extract it, or inspect extraction results.
| name | capa-mcp |
| description | Use when a task needs Mandiant capa through the local `runCapa` or `capaHelp` MCP tools, especially when forming a valid capa command string, choosing output mode, or avoiding path-quoting mistakes. |
Use this skill when working with the local runCapa(...) wrapper.
capaHelp() first.-- before the target path.runCapa(command=...).runCapa(command, rules_dir=None, timeout_sec=300, output_mode="json_compact", max_rules=...)capaHelp(timeout_sec=5)CAPA_RULES_DIR is the first lookup source when set.CAPA_RULES_DIR is unset, this repo prefers ./third_party/capa-rules.CAPA_SIGS_DIR should point at the nested sigs/ directory.CAPA_SIGS_DIR is unset, this repo prefers ./third_party/capa-sigs/sigs../third_party/capa-testfiles/sigs is also accepted if you keep the upstream repo name locally.MCPServers/capa-rules and MCPServers/capa-sigs paths are legacy fallbacks, not the preferred layout.argv[0] must be capa or capa.exe.output_mode="json_compact" unless the task explicitly needs full JSON or raw text.-r <rules_dir> and capa signatures if they are available locally.-t tag when it helps organize intent, for example -t analysis.runCapa(
command='capa -t analysis -- "C:\\Samples\\example.exe"',
output_mode="json_compact"
)
C:\path\to\your\program.exe.