SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
identifying-file-types-and-formats
0
Identifies a sample's true file type independent of its extension: matching magic bytes and structural signatures, detecting container/archive formats, and flagging extension-content mismatches used to disguise malware. Activates for requests to identify a file type, check magic bytes, or detect a disguised/spoofed extension.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Identifying File Types and Formats ## When to Use - You receive an unknown sample and must determine what it actually is before choosing tools. - You suspect masquerading — a `.pdf` or `.jpg` that is really an executable or script. - You need to detect container formats (ZIP/OLE/ISO) that hide a payload. **Do not use** the file extension or the OS-reported type as truth — adversaries rename executables and embed payloads; always confirm by content. ## Prerequisites - `file`/libmagic or an equivalent magic-byte database; the sample handled inertly in the lab. ## Safety & Handling - Never open the sample in its associated application during identification; read raw bytes only. - Keep the disguised extension in mind — a double extension or RTLO trick can mislead the eye. ## Workflow ### Step 1: Read the magic bytes Inspect the leading bytes and known offset signatures (e.g., `MZ`, `\x7fELF`, `%PDF`, `PK\x03\x04`, OLE `D0 CF 11 E0`). ```bash python scripts/analyst.py identify sample.dat ``` ### Step 2: Confirm structure For container formats, confirm internal structure (ZIP central directory, OLE storage, ISO `CD001` at 0x8001) rather than trusting the header alone. ### Step 3: Compare against the claimed extension Flag mismatches: a `.jpg` whose content is `MZ`, or a document that is actually a script. These are strong masquerading indicators. ### Step 4: Route to the right analysis Use the confirmed type to pick the correct workflow (PE static analysis, document analysis, archive extraction). ## Validation - The detected type is confirmed by both magic bytes and structural checks, not magic alone. - Extension/content mismatches are explicitly reported. - The result correctly routes the sample to the appropriate analysis skill. ## Pitfalls - Trusting the first 2 bytes only; some formats need offset or structural confirmation. - Missing polyglot files that are valid as two formats at once. - Overlooking nested containers (archive inside archive) that hide the real payload. ## References - See [`references/api-reference.md`](references/api-reference.md) for the type identifier. - libmagic and the magic-number reference (linked in frontmatter).