binwalk-extract

Firmware image extraction with binwalk and firmware-mod-kit — recursive archive carving, squashfs/jffs2/ubifs mounting, entropy analysis to detect packed/encrypted regions, and nested container handling. Entry point for all static filesystem analysis after a raw binary image is acquired.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, executable, well-sequenced extraction playbook that assumes competence and provides verification plus fallbacks. Its main weakness is the lack of file-based progressive disclosure — everything lives in one large inline document.

Suggestions

Move the Step 6 manual magic-byte carving script and the entropy-interpretation table into a references/ file (e.g. MANUAL_CARVING.md), keeping SKILL.md as an overview that links one level deep.

Extract the per-filesystem recipes (squashfs/jffs2/ubifs variants) into a references/ doc so the main body can stay a concise decision flow.

Add a brief 'See X' navigation pointer near the top so the reader can locate the OPSEC and triage material without scanning the whole file.

Dimension	Reasoning	Score
Conciseness	The body is lean operational bash with terse, purposeful comments and no boilerplate explaining what firmware, squashfs, or binwalk are — it assumes Claude's competence and every comment earns its place.	3 / 3
Actionability	Commands are concrete and copy-paste ready (e.g. 'binwalk -eM -C "$OUTDIR" "$FW"', a complete executable Python magic-byte scanner), with specific flags and output paths rather than pseudocode.	3 / 3
Workflow Clarity	Eight steps are clearly sequenced (identify → extract → per-FS handling → nested → triage) with explicit verification ('Verify extraction: ls /tmp/squashfs_root/{bin,etc,lib,usr,var}') and error-recovery fallbacks ('If both fail, force a specific compression type'; 'when binwalk misses').	3 / 3
Progressive Disclosure	The skill is a single ~240-line monolithic SKILL.md with all content inline and no bundle files (references/, scripts/, assets/ absent) to split material one level deep; sections are well organized but content that could be separated (OPSEC notes, the manual-carving script) is not factored out.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, third-person description that clearly states capabilities and an explicit use condition. It avoids fluff and buzzwords while remaining concise.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete actions — 'recursive archive carving, squashfs/jffs2/ubifs mounting, entropy analysis to detect packed/encrypted regions, and nested container handling' — matching the multi-action anchor.	3 / 3
Completeness	It states both what the skill does and when to use it via the explicit trigger 'Entry point for all static filesystem analysis after a raw binary image is acquired', which is equivalent to a 'Use when...' clause.	3 / 3
Trigger Term Quality	It surfaces the natural terms an analyst would actually say — 'binwalk', 'firmware image extraction', 'squashfs', 'jffs2', 'ubifs', 'entropy analysis', 'nested container' — giving good coverage of domain keywords.	3 / 3
Distinctiveness Conflict Risk	Firmware/binwalk extraction is a sharply defined niche with distinct triggers unlikely to collide with other skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/iot/binwalk-extract/SKILL.md
Commit: e34afba

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.