The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands like python3, node, and npx to execute analysis scripts and utilities. This is part of the standard malware analysis workflow described in the documentation.
[REMOTE_CODE_EXECUTION]: The skill provides examples of using the Node.js vm module to execute potentially malicious JavaScript code within a sandboxed context for deobfuscation. While this carries inherent risk, the skill explicitly mandates the use of an isolated analysis virtual machine (VM) and recommends intercepting dangerous APIs to prevent actual execution of the payload.
[EXTERNAL_DOWNLOADS]: The workflow involves using npx js-beautify, which fetches the beautification utility from the public NPM registry. This is a common practice for formatting JavaScript code during analysis.

deobfuscating-javascript-malware