malware-repo-analysislisted

# Malware Repository Analysis ## Overview Malicious code hides in **execution entry points**, not business logic. Your job is to find anomalies — abnormal network calls, abnormal execution timing, abnormal obfuscation — not to validate correct logic. **Never conclude "safe." Conclude "no indicators found."** Sophisticated attacks (logic bombs, time-triggered backdoors) are invisible to static analysis. ## Agent Teams Architecture Run all phases in parallel using a coordinated Agent Team: ``` Team Lead (you) ├── analyst-metadata (Phase 1+2: Repo metadata + git history) ├── analyst-entrypoints (Phase 3: Execution entry points — HIGH PRIORITY) ├── analyst-sourcecode (Phase 4a-4g: Source code pattern scan) ├── analyst-deps (Phase 5+6: Dependencies + binary files) └── analyst-tests (Phase 7: Test + documentation files) ``` - **Team Lead**: Creates team, spawns analysts, monitors for critical findings, synthesizes final report. - **Analysts**: `general-purpose` agents. Each owns one analysis domain. Reports findings via SendMessage. ## Workflow ### Step 1 — Initial Setup Before spawning: - Confirm the repo is accessible locally (or clone it) - Identify the language/ecosystem (npm, PyPI, Go, Cargo, etc.) - Note the `{repo-path}` and `{repo-slug}` for team naming ### Step 2 — Create Team and Tasks ``` TeamCreate: team_name: "malware-{repo-slug}" description: "Malware analysis for {repo}" ``` Create one task per analyst using TaskCreate. ### Ste