Tessl • The management layer for AI agent skills

SkillPublic

reverser-dotnet-malware

.NET malware analysis — dnSpy/ILSpy decompilation, de-obfuscation (ConfuserEx, .NET Reactor, Babel, Crypto Obfuscator), behavioral analysis of managed assemblies, PowerShell cradle extraction, and config decryption for common .NET RAT families.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/dotnet-malware/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, highly actionable body: executable commands and scripts throughout, a clear numbered workflow with a decision gate, and solid error-recovery guidance. Main deductions are duplicated Quick Reference content, missing validation on later extraction steps, and reference material that could be split into bundle files.

Suggestions

Deduplicate the Quick Reference against sections 1-3, keeping only the genuinely reusable triage commands, or replace the repeated snippets with pointers to the detailed sections.

Add verification after extraction steps, e.g., confirm decrypted config fields are valid UTF-8 and parsed ports are in range, and validate extracted resources have non-zero sizes and correct offsets.

Consider splitting the Detection Signatures table and family-specific config details (AsyncRAT/QuasarRAT/njRAT/AgentTesla) into references/ files to reduce SKILL.md size and improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is command-dense and assumes competence, but the Quick Reference block duplicates commands from sections 1 and 3 (assembly identification, 'de4dot <TARGET> -o <TARGET>.cleaned.exe', ilspycmd decompilation), which is trimmable duplication.	4 / 5
Actionability	Nearly everything is executable: complete Python heredocs for entropy calculation, resource dumping, and AsyncRAT AES-CBC config decryption; concrete bash (de4dot, ilspycmd -p -o, NETReactorSlayer.CLI); and specific grep patterns covering the common cases.	5 / 5
Workflow Clarity	Clear numbered sequence with a decision gate, an explicit validation checkpoint ('Verify result decompiles cleanly'), and error-recovery guidance, but later steps (config extraction, resource dumping) lack verification of their outputs — minor validation gaps.	4 / 5
Progressive Disclosure	No bundle files exist; the single ~290-line SKILL.md is well-sectioned with headers, tables, and a decision gate, but reference material (detection signatures, tools list, family-specific config details) is inlined rather than split into references/.	4 / 5
	Total	17 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and domain-distinct with concrete named tools and techniques, but it omits any explicit 'when to use' trigger clause, capping completeness at 3. Adding a 'Use when...' sentence with natural trigger phrases (e.g., deobfuscate, ConfuserEx, .NET stealer, dnSpy) would lift the two weakest dimensions at once.

Suggestions

Append a 'Use when...' clause with concrete trigger phrases, e.g., 'Use when analyzing .NET samples, deobfuscating ConfuserEx/.NET Reactor packed assemblies, or extracting configs from .NET RATs/stealers'.

Add natural synonyms users would actually say — 'stealer', 'loader', 'C#', 'MSIL', 'reverse engineering' — to improve trigger term coverage.

Sharpen distinctiveness by explicitly scoping to managed/.NET assemblies so it does not compete with generic malware-triage or native-PE skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with named tools: 'dnSpy/ILSpy decompilation', 'de-obfuscation (ConfuserEx, .NET Reactor, Babel, Crypto Obfuscator)', 'PowerShell cradle extraction', 'config decryption for common .NET RAT families' — comprehensive coverage matching the top anchor; no minor gaps in the action list.	5 / 5
Completeness	The 'what' is clear and comprehensive, but the description contains no 'Use when...' clause or equivalent explicit trigger guidance; per the rubric guideline, a missing when-clause caps completeness at 3.	3 / 5
Trigger Term Quality	Good natural keyword coverage ('.NET malware', 'dnSpy', 'ILSpy', 'ConfuserEx', '.NET Reactor', 'RAT', 'de-obfuscation'), but misses common synonyms and extensions a user might say ('stealer', 'loader', 'C#', '.exe', 'reverse engineering'), which the score-5 anchor expects.	4 / 5
Distinctiveness Conflict Risk	Clear niche (.NET managed malware with named tools/obfuscators), but generic terms like 'malware analysis' and 'RAT' create minor overlap risk with closely related triage/Ghidra malware skills referenced as siblings.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/dotnet-malware/SKILL.md
Revision: 49888ee

Reviewed: 25 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

reverser-dotnet-malware

Table of Contents

Is this your skill?