binary-mobile-reversing

APK/EXE/二进制:UniApp/DCloud/Flutter逆向,证书固定绕过,导出组件,内存破坏exploit链,IoT固件。Use when reversing APK/EXE, UniApp/Flutter, native .so, or memory-corruption exploits.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/binary-mobile-reversing/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An information-dense, command-rich playbook that excels on actionability and conciseness for an experienced operator, but it is monolithic rather than progressively disclosed and the referenced bundle files are missing. Workflow clarity is limited by arrow-shorthand sequences without explicit validation checkpoints for destructive or batch operations.

Suggestions

Break the single fenced block into headed subsections (APK, UniApp/DCloud, Flutter, native .so, memory-corruption, IoT) and move the deep offset tables and decode recipes into the referenced files so SKILL.md becomes an overview.

Create the referenced files (references/uniapp-apk-reverse-engineering.md, references/uniapp-apk-reversing.md, scripts/js_rc4_deobfuscate.js, scripts/chengzi_decrypt.py) or remove the dead references.

Add explicit validation/verify checkpoints for batch and destructive steps (e.g. after repinning/repacking, confirm the patched APK installs and the target TLS session is interceptable; after batch string decoding, verify against a known-good string like 'classes.dex').

Dimension	Reasoning	Score
Conciseness	Densely packed reference with almost no concept padding; every line is tool/command/output guidance. It errs slightly toward overload density (many inline pitfalls and offsets) rather than genuine verbosity.	4 / 5
Actionability	Concrete commands dominate (apktool d, jadx, strings -n8 libapp.so\|grep, binwalk -Me, ROPgadget), with specific file offsets and field names. Some multi-step chains are expressed as arrow shorthand rather than executable scripts, leaving minor gaps.	4 / 5
Workflow Clarity	Sequences are conveyed via arrow chains (识别→核心文件→解混淆→陷阱) but there are no explicit validation checkpoints or feedback loops, and several destructive/batch steps (repinning, repacking, batch decoding) lack a verify step.	3 / 5
Progressive Disclosure	The body is a single monolithic fenced block with everything inlined; it points to references/ and scripts/ paths that do not exist in the bundle, and there is no sectioned navigation splitting the APK/UniApp/Flutter/native/exploit subdomains into separate files.	2 / 5
	Total	13 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, trigger-rich description that combines concrete capabilities with an explicit 'Use when' clause across multiple binary/mobile reversing subdomains. It is strong overall, though the heavy keyword compression and very wide scope keep specificity and distinctiveness just below the top anchor.

Suggestions

Tighten scope or split: the description spans APK reversing, Flutter/UniApp, native .so, memory-corruption exploit chains, and IoT firmware; narrowing the stated 'when' triggers would reduce overlap with dedicated exploit-dev skills.

Convert compressed keyword lists into third-person action verbs (e.g. 'Bypasses certificate pinning, extracts exported components, and chains memory-corruption exploits') so capabilities read as concrete actions rather than tag clouds.

Dimension	Reasoning	Score
Specificity	Names the domain plus several concrete actions ('证书固定绕过', '导出组件', '内存破坏exploit链', 'IoT固件逆向'), though each action is compressed into keyword form rather than fully elaborated.	4 / 5
Completeness	Explicitly answers what it does in the first clause and when to use it via the 'Use when reversing APK/EXE, UniApp/Flutter, native .so, or memory-corruption exploits' clause.	5 / 5
Trigger Term Quality	Covers natural trigger terms across formats and synonyms ('APK/EXE', 'UniApp/Flutter', 'native .so', 'memory-corruption exploits'), matching how a user would phrase the need.	5 / 5
Distinctiveness Conflict Risk	The niche is clear (mobile/binary reversing with specific frameworks), but the broad span from APK reversing to memory-corruption exploit chains and IoT firmware creates minor overlap risk with separate exploit-dev or firmware skills.	4 / 5
	Total	18 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
referenced_paths_exist	Referenced path issues: 9 missing, 1 deeper-than-1-level	Warning

	Total	13 / 16 Passed

Repository: Ed1s0nZ/CyberStrikeAI
Path: skills/binary-mobile-reversing/SKILL.md
Commit: 893f134

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.