Skip to main content
security-sandbox Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and process changes.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/a5c-ai/babysitter --skill security-sandboxO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Explorador de arquivos
2 arquivos Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
Reference for querying the Atlas knowledge graph through its MCP tools — the SECONDARY enrichment/comparison layer that adds best-practice context to systems you have ALREADY scanned from your real sources (`az`, repos, dirs). Use when you need to look up nodes, edges, kinds, clusters, stats, or wiki pages in Atlas to compare against your real inventory. (atlas graph, query atlas, atlas mcp, search the graph, graph neighbors, atlas record, atlas kinds, enrichment layer)
Atlas turns your STATED NEED into a real systems atlas by SCANNING your actual sources (Azure via `az`, git repos, local dirs) and process/data mining them, THEN enriching against the Atlas knowledge graph. Use this skill when asked to inventory/map your real systems, scan your cloud + repos + directories, mine the real processes or data they contain, or collect their real constraints/gotchas. (atlas, scan my systems, inventory our azure account, map my repos, real systems atlas, process mining, data mining, collect nuances, system discovery)
assimilate-popular-workflows This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
name security-sandbox description Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and process changes. allowed-tools Bash(*) Read Write Edit Glob Grep WebFetch metadata {"author":"babysitter-sdk","version":"1.0.0","category":"analysis-environment","backlog-id":"SK-008"} graph {"domains":["domain:cybersecurity"],"specializations":["specialization:security-research"],"skillAreas":["skill-area:endpoint-security-edr","skill-area:incident-response-forensics"],"roles":["role:security-engineer"],"workflows":["workflow:penetration-testing-cycle","workflow:vulnerability-management"]}
security-sandbox
You are security-sandbox - a specialized skill for isolated analysis environment management, providing capabilities for safe malware analysis, exploit testing, and dynamic security research.
Overview
This skill enables AI-powered sandbox operations including:
Creating and managing isolated virtual machines
Configuring Cuckoo Sandbox for automated malware analysis
Setting up REMnux and FlareVM analysis environments
Managing Docker-based analysis containers
Configuring network isolation and traffic capture
Monitoring filesystem, registry, and process changes
Creating and restoring environment snapshots
Prerequisites
Virtualization : VirtualBox, VMware, or KVM/QEMUCuckoo Sandbox : Python-based automated malware analysisDocker : For containerized analysis environmentsNetwork Tools : Inetsim, FakeDNS for network simulationAnalysis VMs : REMnux, FlareVM images
IMPORTANT: Safety First This skill is designed for authorized security research. All operations:
Must be conducted in properly isolated environments
Should never allow malware to escape containment
Require careful network isolation configuration
Must preserve evidence for forensic analysis
Capabilities
1. Virtual Machine Management Create and manage isolated analysis VMs:
VBoxManage createvm --name "MalwareAnalysis" --ostype "Windows10_64" --register
VBoxManage modifyvm "MalwareAnalysis" \
--memory 4096 \
--cpus 2 \
--vram 128 \
--nic1 intnet \
--intnet1 "analysis-net" \
--audio none \
--clipboard disabled \
--draganddrop disabled
VBoxManage snapshot "MalwareAnalysis" take "clean-state" --description "Clean analysis state"
VBoxManage snapshot "MalwareAnalysis" restore "clean-state"
VBoxManage startvm "MalwareAnalysis" --type headless
VBoxManage controlvm "MalwareAnalysis" poweroff
2. Cuckoo Sandbox Configuration Set up and manage Cuckoo Sandbox:
pip install cuckoo
cuckoo init
cuckoo community
[cuckoo]
machinery = virtualbox
memory_dump = yes
enforce_timeout = yes
max_analysis_count = 50
[resultserver]
ip = 192.168 .56.1
port = 2042
[processing]
analysis_size_limit = 134217728
[virtualbox]
mode = headless
path = /usr/bin/VBoxManage
interface = vboxnet0
[analysis1]
label = MalwareAnalysis
platform = windows
ip = 192.168 .56.101
snapshot = clean-state
resultserver_ip = 192.168 .56.1
resultserver_port = 2042
tags = win10,64 bit
cuckoo submit /path/to/sample.exe --timeout 120 --enforce-timeout
cuckoo -d
cuckoo web runserver 0.0.0.0:8080
3. Docker Analysis Containers Create isolated analysis containers:
# Dockerfile for analysis environment
FROM remnux/remnux-distro:focal
# Install additional tools
RUN apt-get update && apt-get install -y \
radare2 \
yara \
volatility3 \
strace \
ltrace
# Create analysis directory
WORKDIR /analysis
VOLUME /samples
VOLUME /output
# Network isolation
# Run with --network none for full isolation
ENTRYPOINT ["/bin/bash"]
docker build -t malware-analysis:latest .
docker run -it --rm \
--network none \
--memory 4g \
--cpus 2 \
--read-only \
--tmpfs /tmp:rw,noexec,nosuid \
-v /path/to/samples:/samples:ro \
-v /path/to/output:/output:rw \
malware-analysis:latest
docker run -it --rm \
--network analysis-net \
--cap-drop ALL \
--security-opt no-new-privileges \
-v /path/to/samples:/samples:ro \
malware-analysis:latest
4. Network Isolation and Simulation Configure network isolation for safe analysis:
VBoxManage hostonlyif create
VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 --netmask 255.255.255.0
sudo inetsim --config /etc/inetsim/inetsim.conf
fakedns -i 192.168.56.1
tcpdump -i vboxnet0 -w /analysis/traffic.pcap
sudo iptables -I FORWARD -i vboxnet0 -o eth0 -j DROP
sudo iptables -I FORWARD -i eth0 -o vboxnet0 -j DROP
service_bind_address 192.168.56.1
dns_default_ip 192.168.56.1
start_service dns
start_service http
start_service https
start_service smtp
start_service pop3
start_service ftp
5. REMnux Analysis Environment Set up REMnux for malware analysis:
wget https://REMnux.org/remnux-cli
chmod +x remnux-cli
sudo mv remnux-cli /usr/local/bin/remnux
sudo remnux install
peframe malware.exe
pescanner malware.exe
pdfid suspicious.pdf
oledump.py document.doc
procmon
regmon
fakenet
vol.py -f memory.dmp imageinfo
vol.py -f memory.dmp --profile=Win10x64 pslist
6. FlareVM for Windows Analysis Configure FlareVM analysis environment:
# Install FlareVM (run in elevated PowerShell)
Set-ExecutionPolicy Bypass -Scope Process -Force
# Download and run installer
iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1'))
# Key FlareVM tools
# PE Analysis
pestudio.exe malware.exe
die.exe malware.exe # Detect It Easy
cffexplorer.exe malware.exe
# Debugging
x64dbg.exe
windbg.exe
# Network
wireshark.exe
fakenet-ng.exe
# Decompilation
ghidra.exe
ida64.exe
7. Process and Filesystem Monitoring Monitor changes during analysis:
sysdig -c spy_users
inotifywait -m -r /home/analysis --format '%w%f %e' -e modify,create,delete
procmon &
strace -f -o /output/syscalls.log ./sample
wine reg export HKLM /output/hklm_before.reg
wine reg export HKLM /output/hklm_after.reg
diff hklm_before.reg hklm_after.reg
8. Snapshot Management Create and manage analysis snapshots:
VBoxManage snapshot "AnalysisVM" take "pre-analysis-$(date +%Y%m%d-%H%M%S) "
VBoxManage snapshot "AnalysisVM" list
VBoxManage snapshot "AnalysisVM" restore "clean-state"
VBoxManage snapshot "AnalysisVM" delete "old-snapshot"
docker checkpoint create analysis-container checkpoint1
docker start --checkpoint checkpoint1 analysis-container
virsh snapshot-create-as AnalysisVM clean-state "Clean state for analysis"
virsh snapshot-revert AnalysisVM clean-state
virsh snapshot-list AnalysisVM
9. Automated Analysis Pipeline
"""Automated malware analysis pipeline"""
import subprocess
import hashlib
import json
import os
from datetime import datetime
class AnalysisPipeline :
def __init__ (self, sample_path, output_dir ):
self .sample_path = sample_path
self .output_dir = output_dir
self .results = {}
def calculate_hashes (self ):
"""Calculate file hashes"""
with open (self .sample_path, 'rb' ) as f:
data = f.read()
return {
'md5' : hashlib.md5(data).hexdigest(),
'sha1' : hashlib.sha1(data).hexdigest(),
'sha256' : hashlib.sha256(data).hexdigest()
}
def static_analysis (self ):
"""Run static analysis tools"""
subprocess.run(['yara' , '-r' , '/rules/' , self .sample_path],
capture_output=True )
subprocess.run(['peframe' , self .sample_path],
capture_output=True )
subprocess.run(['strings' , '-a' , self .sample_path],
stdout=open (f'{self.output_dir} /strings.txt' , 'w' ))
def restore_snapshot (self ):
"""Restore VM to clean state"""
subprocess.run([
'VBoxManage' , 'snapshot' , 'AnalysisVM' ,
'restore' , 'clean-state'
])
def run_dynamic_analysis (self, timeout=120 ):
"""Execute sample in sandbox"""
result = subprocess.run([
'cuckoo' , 'submit' , self .sample_path,
'--timeout' , str (timeout)
], capture_output=True )
return result
def collect_artifacts (self ):
"""Collect analysis artifacts"""
artifacts = {
'pcap' : f'{self.output_dir} /traffic.pcap' ,
'memory_dump' : f'{self.output_dir} /memory.dmp' ,
'screenshots' : f'{self.output_dir} /screenshots/' ,
'dropped_files' : f'{self.output_dir} /dropped/'
}
return artifacts
def generate_report (self ):
"""Generate analysis report"""
report = {
'timestamp' : datetime.now().isoformat(),
'sample' : self .sample_path,
'hashes' : self .calculate_hashes(),
'results' : self .results
}
with open (f'{self.output_dir} /report.json' , 'w' ) as f:
json.dump(report, f, indent=2 )
MCP Server Integration This skill can leverage the following tools:
Analysis Environment Profiles environment_profiles:
malware_analysis:
vm_type: windows10
memory: 4096
cpus: 2
network: isolated
snapshots: true
tools:
- procmon
- fakenet
- x64dbg
- pestudio
exploit_testing:
vm_type: ubuntu
memory: 2048
cpus: 2
network: host-only
snapshots: true
tools:
- gdb
- pwntools
- radare2
web_analysis:
container: remnux
memory: 2048
network: simulated
tools:
- burp
- mitmproxy
- chrome-sandbox
Process Integration This skill integrates with the following processes:
malware-analysis.js - Automated malware analysisexploit-development.js - Exploit testing environmentssecurity-research-lab-setup.js - Lab environment creationdynamic-analysis-runtime-testing.js - Runtime analysis
Output Format When executing operations, provide structured output:
{
"environment" : {
"type" : "virtualbox" ,
"vm_name" : "MalwareAnalysis" ,
"snapshot" : "clean-state" ,
"network" : "isolated"
} ,
"analysis" : {
"sample_hash" : "abc123..." ,
"duration" : 120 ,
"status" : "completed"
} ,
"findings" : {
"network_activity" : [ "185.123.45.67:443" ] ,
"file_operations" : [ "C:\\Windows\\Temp\\dropper.exe" ] ,
"registry_changes" : [ "HKCU\\Software\\Microsoft\\Windows\\Run" ] ,
"processes_created" : [ "cmd.exe" , "powershell.exe" ]
} ,
"artifacts" : {
"pcap" : "/output/traffic.pcap" ,
"memory_dump" : "/output/memory.dmp" ,
"screenshots" : [ "/output/screen_001.png" ]
}
}
Error Handling
Verify VM/container health before analysis
Implement timeout mechanisms for hung analyses
Preserve partial results on failure
Log all environment state changes
Validate network isolation before sample execution
Constraints
Never analyze malware on production systems
Always verify network isolation before execution
Maintain evidence chain of custody
Document all environment configurations
Keep malware samples in encrypted storage
Follow organizational malware handling policies
