v1.3.0 — Agentic malware analysis + plugin

Changed

• Skills rewritten as agent instructions. Every phase now tells Claude what to run and interpret on the host instead of guiding a human through it. Each SKILL.md opens with an Execution Model (what Claude runs, what is VM-only, what to ask the user for).
• malware-triage — full rewrite: file → route, pe_info.py interpretation table, ASCII+UTF-16 strings, ioc_extract.py, packed-sample handling, unknown-file carving (XOR/base64/gzip), batch mode, state-file output.
• malware-dynamic-analysis — split into Part A (VM runbook for the analyst, tailored from triage predictions, ending in text-format export commands: Procmon CSV, Sysmon JSON, tshark, autoruns, dropped files) and Part B (Claude parses the evidence: process tree, injection, persistence, C2/beaconing, dropped files, memory strings, sandbox reports). Binary-evidence conversion table added.
• specialized-file-analyzer — host-first workflows: ilspycmd decompilation with grep patterns, Python static decoders for PowerShell (-EncodedCommand, gzip), VBScript (Chr/Replace/StrReverse), JS escapes; PSDecode / cscript / strace / dnSpy marked VM-only.
• detection-engineer — derives rules from the evidence files, writes them to detections/, runs sigma check / suricata -T when available, uses ioc_extract.py for defanging and export.
• malware-report-writer — reads analysis_state.md and evidence instead of asking for findings; authors and yara-tests the rule; writes reports/<sample>_report.md.
• Orchestrator — Execution Model, bundled-script table, host tool check, runbook-based VM boundary, sub-skill path note.
• README — real install instructions (git clone into ~/.claude/skills/, only the orchestrator registers), updated CAN/CANNOT, compact sub-skill table, evidence-driven usage example.

Added

• Claude Code plugin packaging — .claude-plugin/plugin.json and .claude-plugin/marketplace.json. Install with /plugin marketplace add gl0bal01/malware-analysis-claude-skills then /plugin install malware-analysis. Only the orchestrator registers as a skill; sub-skills load by path. Skills resolve their files via $CLAUDE_PLUGIN_ROOT (plugin) or the skill directory (git clone).
• Test harness + CI — tests/run.sh (8 stages), tests/make_pe.py (deterministic benign PE fixture), tests/fixtures/ (Procmon/Sysmon/tshark evidence, obfuscated scripts, YARA rule), tests/extract_rules.py; .github/workflows/test.yml runs it on push/PR. Core runs stdlib-only; optional tool checks (pefile/yara/sigma) skip gracefully.
• docs/example-triage.md — a real, unedited autonomous triage transcript produced by Claude running the skill headless against the fixture.
• malware-dynamic-analysis/scripts/procmon_summary.py — Procmon CSV → process tree, file/registry writes (persistence flagged), network, non-system image loads; scoped to a process and its descendants.
• malware-dynamic-analysis/scripts/sysmon_summary.py — Sysmon (PowerShell JSON/CSV or evtx_dump JSONL) → tree, network with beacon-interval detection, DNS, files, registry, remote threads, process access, pipes, WMI, tampering.
• Both readers accept UTF-16 (PowerShell 5.1 default) and UTF-8; both have --self-test.

Removed

• Quick_Start.md (subset of README with incorrect install steps).
• Duplicated "Report Quality Checklist" from best_practices.md (kept in the report-writer SKILL.md) and the human-oriented "Time Management" section from the report-writer SKILL.md.