reverser-malware-triage

Fast malware triage workflow — static (PE/Mach-O/ELF format, strings, imports, signatures, entropy/packed indicators), dynamic (sandbox with INetSim, Wireshark, Process Monitor, Procmon, time-shift), unpack (Scylla/PE-sieve), then full RE with Ghidra/IDA. Designed for ≤15 min initial verdict.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/malware-triage/SKILL.md

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, copy-paste-ready commands and decision tables, well-organized into a clear phased workflow with sensible external references. Its main gaps are missing validation checkpoints for risky malware-detonation steps and minor redundancy that could be trimmed.

Suggestions

Add explicit validation gates before snapshot/revert (e.g. confirm Procmon capture saved and PCAP non-empty before reverting the VM) to support a feedback loop.

De-duplicate tool mentions (INetSim, Procmon/Process Monitor) that recur across description, phases, tables, and references.

Trim asides Claude already knows ('Often the verdict already exists — saves you 14 minutes', 'still the canonical book').

Dimension	Reasoning	Score
Conciseness	Mostly lean with direct commands and tables, but includes redundancy (INetSim repeated across description, phase, table, and references; 'Process Monitor' and 'Procmon' both listed) and a few unnecessary asides Claude already knows ('Often the verdict already exists — saves you 14 minutes', 'still the canonical book'); not 3 because some tokens don't earn their place.	2 / 3
Actionability	Provides fully executable guidance — real commands (file, exiftool, strings, yara), a complete pefile snippet, a working entropy script, 'pe-sieve.exe /pid 1234 /dir dumped', and copy-paste-ready signal→verdict tables; not 2 because nothing is pseudocode or vague.	3 / 3
Workflow Clarity	A clear four-phase sequence with time budgets and a verdict decision table, but it involves risky/destructive operations (detonating malware, VM snapshot/revert) with no explicit validation checkpoints or feedback loops — e.g. 'Observe for 60-180 seconds, then take snapshot' has no gating step — which per the rubric caps workflow clarity at 2.	2 / 3
Progressive Disclosure	Single-file skill (~130 lines) with no bundle files present, well-organized into per-phase sections, a one-level-deep clearly-signaled reference to 'reverser/ghidra/SKILL.md', and a References section; for a skill this size, well-organized sections satisfy the highest anchor.	3 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and distinct, clearly scoping a malware triage workflow with concrete tooling, but it lacks an explicit 'Use when...' trigger clause and leans on technical jargon over natural user phrasing. Adding a natural-language trigger sentence would lift completeness and trigger-term quality.

Suggestions

Add an explicit trigger clause, e.g. 'Use when a user asks for a first look at a suspicious binary, sample, or possible malware.'

Surface natural user phrasings like 'malware analysis', 'is this malware', and 'analyze this sample' alongside the technical terms.

Drop redundant tool variants (e.g. 'Process Monitor, Procmon') to tighten the description without losing keywords.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across phases — 'static (PE/Mach-O/ELF format, strings, imports, signatures, entropy/packed indicators)', 'dynamic (sandbox with INetSim, Wireshark, Process Monitor, Procmon, time-shift)', 'unpack (Scylla/PE-sieve)', 'then full RE with Ghidra/IDA' — matching the highest anchor; not 2 because coverage is comprehensive rather than partial.	3 / 3
Completeness	The 'what' is answered thoroughly but there is no explicit 'Use when...' trigger clause — 'when' is only implied by 'Designed for ≤15 min initial verdict', which per the rubric caps completeness at 2 rather than 3.	2 / 3
Trigger Term Quality	Contains domain keywords (malware, triage, sandbox, packed, entropy, Ghidra, IDA) but leans technical and omits common natural phrasings a user would say ('analyze this sample', 'is this malware', 'malware analysis'); not 3 because natural-term coverage is incomplete, not 1 because several relevant terms are present.	2 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (malware triage first-look) with distinct triggers unlikely to fire for unrelated skills; not 2 because the tooling and phase list make it sharply distinguishable from generic RE skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/malware-triage/SKILL.md
Commit: e34afba

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.