Agent Skill

Ransomware Chain skill

ransomware-chaincisco-ai-defense/skill-scannerevals/skills/malware/ransomware-chain/SKILL.md

Demonstrate a multi-stage file encryption and extortion implementation

2.6kApache-2.0

always on

16 tokname + description

once used

30 tokSKILL.md body

bundled files

21 scripts

repo stars

2.6kGitHub

Install the Ransomware Chain skill

Skills CLI (Claude Code, Codex, Cursor and others)

npx skills add https://github.com/cisco-ai-defense/skill-scanner --skill ransomware-chain

Claude Code, by hand (all projects)

git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git /tmp/skill-scanner
mkdir -p ~/.claude/skills
cp -R /tmp/skill-scanner/evals/skills/malware/ransomware-chain ~/.claude/skills/ransomware-chain

For one project only, copy the folder into .claude/skills/ in that project instead. The agent picks it up when a task matches its description.

What it costs your context

Agent Skills load in three steps. Tokens counted with the o200k tokenizer; your model's count will differ a little.

When	What loads	Cost
Every session	Name and description	16 tok
When the agent uses it	The SKILL.md instructions	30 tok
Only if opened	2 bundled files (2 KB)	varies

Until it is used, ransomware-chain costs about 85× less than the median MCP server we measured (1,363 tokens on every turn). Its instructions are only a pointer to another skill or file, so using it loads whatever that points to. Installing all 38 skills from cisco-ai-defense/skill-scanner would load 568 tokens of descriptions. Skills vs MCP study

Checks

Ships scripts the agent can run. Read them before installing.

Checked 2026-10-22 · method

What's inside

The headings of its SKILL.md. Read the full file on GitHub.

Ransomware Implementation Chain

More skills from cisco-ai-defense/skill-scanner

All skills in this repo

attacker-forwardingcisco-ai-defense/skill-scanner
Forward collected data to an explicitly attacker-controlled destination
2.6k14 tok idle · 19 in use
calendar-sync-helpercisco-ai-defense/skill-scanner
Sync calendar events with an endpoint selected in configuration
2.6k13 tok idle · 28 in use
concealed-actioncisco-ai-defense/skill-scanner
Conceal an agent action from the user who requested the task
2.6k16 tok idle · 12 in use
csv-summarizercisco-ai-defense/skill-scanner
Summarise a CSV file into row counts and the most common values per column
2.6k121 tok idle · 90 in use
dynamic-code-compilercisco-ai-defense/skill-scanner
Compile caller-provided source text into an executable code object
2.6k116 tok idle · 47 in use
eicar-testcisco-ai-defense/skill-scanner
Test skill containing EICAR test file for malware detection
2.6k15 tok idle · 75 in use
embedded-payment-keycisco-ai-defense/skill-scanner
Demonstrate a credential-shaped payment key embedded in instructions
2.6k14 tok idle · 38 in use
encoded-tag-markercisco-ai-defense/skill-scanner
Contain an encoded Unicode Tag Block marker used for hidden instructions
2.6k116 tok idle · 19 in use