anti-debug-bypass

Detect and neutralize anti-debug / anti-VM checks — IsDebuggerPresent, ptrace, NtGlobalFlag, timing, hardware-breakpoint detection.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and token-efficient with concrete executable examples, but it presents everything inline in one large file and lacks formal validation feedback loops around the destructive patching workflow.

Suggestions

Add an explicit validate→fix→retry feedback loop around patching (e.g., 'After wx patch, run yara validation; if it fails, revert the patch and retry') to raise workflow clarity.

Split the LD_PRELOAD example and the tool cheat sheet into references/ files and link to them from the body to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is lean — tables of checks/bypasses and direct code with no re-explanation of basic concepts like what ptrace or a PEB is — so nearly every token earns its place.	3 / 3
Actionability	It provides fully executable guidance: a complete LD_PRELOAD bypass.c with gcc build line, concrete gdb/r2/x64dbg commands, strings/grep/YARA scans, and specific patch bytes, all copy-paste ready.	3 / 3
Workflow Clarity	Sections are numbered (enumerate → bypass → dynamic → patch → promote) giving a clear sequence, but validation checkpoints are only implicit — the post-patch YARA note is a caution, not a formal validate→fix→retry feedback loop, which caps the score for destructive patching.	2 / 3
Progressive Disclosure	The ~190-line body is a single monolithic file with no bundle files and no signaled references; the tool cheat sheet and the LD_PRELOAD example could reasonably be split into reference files for better disclosure.	2 / 3
	Total	10 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-targeted, and uses natural trigger terms with correct third-person voice, but it omits an explicit 'Use when' trigger clause in the description field itself. Adding an explicit usage trigger would raise completeness.

Suggestions

Append an explicit 'Use when...' clause to the description (e.g., 'Use when dynamically analyzing malware or protected binaries that fail under a debugger or in a sandbox').

Move a few natural-language trigger phrases (e.g., 'debugger detection', 'sandbox evasion', 'anti-analysis') into the description itself rather than only in metadata.when_to_use.

Dimension	Reasoning	Score
Specificity	Names concrete actions ('Detect and neutralize') alongside multiple specific techniques (IsDebuggerPresent, ptrace, NtGlobalFlag, timing, hardware-breakpoint detection), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	The description clearly states what the skill does, but it lacks an explicit 'Use when...' trigger clause — that guidance lives only in metadata.when_to_use — so completeness is capped at 2 per the missing-trigger guideline.	2 / 3
Trigger Term Quality	Anti-debug, ptrace, IsDebuggerPresent, timing, and hardware-breakpoint are natural terms a reverse-engineering user would actually say when they need this skill, giving good keyword coverage.	3 / 3
Distinctiveness Conflict Risk	The anti-debug/anti-VM bypass niche is narrow with distinct technical triggers, making it unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/anti-debug-bypass/SKILL.md
Commit: e34afba

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.